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FOREWORD 


This  document  constitutes  the  final  report  of  the  Current  Technology  ACT  Control 
System  Definition  and  the  Advanced  Technology  ACT  Control  System  Definition  Tasks  of 
the  Integrated  Application  of  Active  Controls  (lAAC)  Technology  to  an  Advanced  Subsonic 
Transport  Project.  The  report  covers  work  performed  from  3uly  1978  through  October 
1980  under  Contracts  NASl-1^742  and  NASl-15325. 


Volume  I contains  the  principal  results  of  the  study,  and  supplementary  technical  data  are 
contained  in  Volume  II. 

The  NASA  Technical  Monitors  for  these  contract  tasks  were  R.  V.  Hood  and  D.  B. 
Middleton  of  the  Energy  Efficient  Transport  Project  Office  at  Langley  Research  Center. 
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E.  T.  Reiquam 

Systems  Technology 

J.  Shen 

Flight  Controls  Technology 

R.  D.  Smith 

Flight  Control  Design 

T.  D.  Verrill 

Flight  Control  Design 

T.  B.  Cunningham 

Honeywell  Systems  and  Research  Center 

3.  C.  Larson 

Honeywell  Avionics  Division 

E.  R.  Rang 

Honeywell  Systems  and  Research  Center 

R.  K.  Mason 

Hydraulic  Research  Textron 

O.  A.  Walkes 

Hydraulic  Research  Textron 

During  this  study,  principal  measurements  and  calculations  were  made  in  U.S.  customary 
units  and  were  converted  to  Standard  International  units  for  this  document. 

Use  of  trade  names  or  names  of  manufacturers  in  this  report  does  not  constitute  an 
official  endorsement  of  such  products  or  manufacturers,  either  expressed  or  implied,  by 
the  National  Aeronautics  and  Space  Administration. 
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(Elevator  Displacement) F-28 

F-35  Power-Spectral-Density  Plot,  Flight  Condition  2 

(Elevator  Rate) F-28 

F-36  Power-Spectral-Density  Plot,  Flight  Condition  2 

(Aileron  Displacement) F-29 

F-37  Power-Spectral-Density  Plot,  Flight  Condition  2 

(Aileron  Rate) F-29 

F-38  Power-Spectral-Density  Plot,  Flight  Condition  3 

(Elevator  Displacement) F-30 

F-39  Power-Spectral-Density  Plot,  Flight  Condition  3 

(Elevator  Rate) F-30 

F-40  Power-Spectral-Density  Plot,  Flight  Condition  3 

(Aileron  Displacement) F-31 

F-41  Power-Spectral-Density  Plot,  Flight  Condition  3 

(Aileron  Rate) F-31 

F-42  Power-Spectral-Density  Plot,  Flight  Condition  4 

(Elevator  Displacement) F-32 
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F-43  Power-Spectral-Density  Plot,  Flight  Condition  ^ 

(Elevator  Rate) . F-32 

F-UU  Power-Spectral-Density  Plot,  Flight  Condition  4 

(Aileron  Displacement) F-33 

F-^5  Power-Spectral-Density  Plot,  Flight  Condition  4 

(Aileron  Rate) F-33 

F-46  Phase  and  Gain  Margin,  Elevator  Loop,  Filter  Type  B, 

Flight  Condition  1 F-43 

F-47  Phase  and  Gain  Margin,  Aileron  Loop,  Filter  Type  B, 

Flight  Condition  1 F-43 

F-48  Phase  and  Gain  Margin,  Elevator  Loop,  Filter  Type  B, 

Flight  Condition  2 F-44 

F-49  Phase  and  Gain  Margin,  Aileron  Loop,  Filter  Type  B, 

Flight  Condition  2 F-44 

F-50  Phase  and  Gain  Margin,  Elevator  Loop,  Filter  Type  B, 

Flight  Condition  3 ...  . F-45 

F-51  Phase  and  Gain  Margin,  Aileron  Loop,  Filter  Type  B, 

Flight  Condition  3 . F-45 

F-52  Phase  and  Gain  Margin,  Elevator  Loop,  Filter  Type  B, 

Flight  Condition  4 F-46 

F-53  Phase  and  Gain  Margin,  Aileron  Loop,  Filter  Type  B, 

Flight  Condition  4 F-46 

F-54  Phase  and  Gain  Margin,  Elevator  Loop,  Filter  Type  C, 

Flight  Condition  1 F-47 

F-55  Phase  and  Gain  Margin,  Aileron  Loop,  Filter  Type  C, 

Flight  Condition  1 F-47 

F-56  Phase  and  Gain  Margin,  Elevator  Loop,  Filter  Type  C, 

Flight  Condition  3 F-48 

F-57  Phase  and  Gain  Margin,  Aileron  Loop,  Filter  Type  C, 

Flight  Condition  3 F-48 
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F-58  Phase  and  Gain  Margin,  Elevator  Loop,  Filter  Type  D, 

Flight  Condition  1 F-49 

F-59  Phase  and  Gain  Margin,  Aileron  Loop,  Filter  Type  D, 

Flight  Condition  1 F-49 

F-60  Phase  and  Gain  Margin,  Elevator  Loop,  Filter  Type  D, 

Flight  Condition  2 F-50 

F-61  Phase  and  Gain  Margin,  Aileron  Loop,  Filter  Type  D, 

Flight  Condition  2 F-50 

F-62  Phase  and  Gain  Margin,  Elevator  Loop,  Filter  Type  D, 

Flight  Condition  3 F-51 

F-63  Phase  and  Gain  Margin,  Aileron  Loop,  Filter  Type  D, 

Flight  Condition  3 F-51 

F-64  Phase  and  Gain  Margin,  Elevator  Loop,  Filter  Type  D, 

Flight  Condition  4 F-52 

F-65  Phase  and  Gain  Margin,  Aileron  Loop,  Filter  Type  D, 

Flight  Condition  k F-52 

F-66  Phase  and  Gain  Margin,  Elevator  Loop,  Filter  Type  E, 

Flight  Condition  1 F-53 

F-67  Phase  and  Gain  Margin,  Aileron  Loop,  Filter  Type  E, 

Flight  Condition  1 F-53 

F-68  Phase  and  Gain  Margin,  Elevator  Loop,  Filter  Type  E, 

Flight  Condition  2 F-54 

F-69  Phase  and  Gain  Margin,  Aileron  Loop,  Filter  Type  E, 

Flight  Condition  2 F-54 

F-70  Phase  and  Gain  Margin,  Elevator  Loop,  Filter  Type  E, 

Flight  Condition  3 F-55 

F-7 1 Phase  and  Gain  Margin,  Aileron  Loop,  Filter  Type  E, 

Flight  Condition  3 F-55 

F-72  Phase  and  Gain  Margin,  Elevator  Loop,  Filter  Type  E, 

Flight  Condition  4 F-56 

F-73  Phase  and  Gain  Margin,  Aileron  Loop,  Filter  Type  E, 

Flight  Condition  4 F-56 
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F-74  Phase  and  Gain  Margin,  Elevator  Loop,  Filter  Types  F 

and  H,  Flight  Condition  1 F-57 

F-75  Phase  and  Gain  Margin,  Aileron  Loop,  Filter  Types  F 

and  H,  Flight  Condition  1 F-57 

F-76  Phase  and  Gain  Margin,  Elevator  Loop,  Filter  Types  F 

and  H,  Flight  Condition  2 F-58 

F-77  Phase  and  Gain  Margin,  Aileron  Loop,  Filter  Types  F 

and  H,  Flight  Condition  2 F-58 

F-78  Phase  and  Gain  Margin,  Elevator  Loop,  Filter  Types  F 

and  H,  Flight  Condition  3 F-59 

F-79  Phase  and  Gain  Margin,  Aileron  Loop,  Filter  Types  F 

and  H,  Flight  Condition  3 F-59 

F-80  Phase  and  Gain  Margin,  Elevator  Loop,  Filter  Types  F 

and  H,  Flight  Condition  4 F-60 

F-81  Phase  and  Gain  Margin,  Aileron  Loop,  Filter  Types  F 

and  H,  Flight  Condition  k F-60 

F-82  Phase  and  Gain  Margin,  Elevator  Loop,  Filter  Type  B, 

Flight  Condition  5 F-70 

F-83  Phase  and  Gain  Margin,  Aileron  Loop,  Filter  Type  B, 

Flight  Condition  5 F-70 

F-84  Phase  and  Gain  Margin,  Elevator  Loop,  Filter  Type  B, 

Flight  Condition  6 F-71 

F-85  Phase  and  Gain  Margin,  Aileron  Loop,  Filter  Type  B, 

Flight  Condition  6 F-71 

F-86  Phase  and  Gain  Margin,  Elevator  Loop,  Filter  Type  B, 

Flight  Condition  7 F-72 

F-87  Phase  and  Gain  Margin,  Aileron  Loop,  Filter  Type  B, 

Flight  Condition  7 F-72 

F-88  Phase  and  Gain  Margin,  Elevator  Loop,  Filter  Type  B, 

Flight  Condition  8 F-73 

F-89  Phase  and  Gain  Margin,  Aileron  Loop,  Filter  Type  B, 

Flight  Condition  8 F-73 
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F-90  Phase  and  Gain  Margin,  Elevator  Loop,  Filter  Type  C, 

Flight  Condition  5 F-7^ 

F-91  Phase  and  Gain  Margin,  Aileron  Loop,  Filter  Type  C, 

Flight  Condition  5 . F-74 

F-92  Phase  and  Gain  Margin,  Elevator  Loop,  Filter  Type  C, 

Flight  Condition  6 F-75 

F-93  Phase  and  Gain  Margin,  Aileron  Loop,  Filter  Type  C, 

Flight  Condition  6 F-75 

F-94  Phase  and  Gain  Margin,  Elevator  Loop,  Filter  Type  D, 

Flight  Condition  5 F-76 

F-95  Phase  and  Gain  Margin,  Aileron  Loop,  Filter  Type  D, 

Flight  Condition  5 F-76 

F-96  Phase  and  Gain  Margin,  Elevator  Loop,  Filter  Types  D 

and  G,  Flight  Condition  6 F-77 

F-97  Phase  and  Gain  Margin,  Aileron  Loop,  Filter  Types  D 

and  G,  Flight  Condition  6 F-77 

F-98  Phase  and  Gain  Margin,  Elevator  Loop,  Filter  Type  D, 

Flight  Condition  7 F-78 

F-99  Phase  and  Gain  Margin,  Aileron  Loop,  Filter  Type  D, 

Flight  Condition  7 F-78 

F-lOO  Phase  and  Gain  Margin,  Elevator  Loop,  Filter  Type  D, 

Flight  Condition  8 F-79 

F-101  Phase  and  Gain  Margin,  Aileron  Loop,  Filter  Type  D, 

Flight  Condition  8 F-79 

F-102  Phase  and  Gain  Margin,  Elevator  Loop,  Filter  Type  G, 

Flight  Condition  5 F-80 

F-103  Phase  and  Gain  Margin,  Aileron  Loop,  Filter  Type  G, 

Flight  Condition  5 F-80 

F-104  Phase  and  Gain  Margin,  Elevator  Loop,  Filter  Type  G, 

Flight  Condition  7 F-81 

F-105  Phase  and  Gain  Margin,  Aileron  Loop,  Filter  Type  G, 

Flight  Condition  7 F-81 
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F-106  Phase  and  Gain  Margin,  Elevator  Loop,  Filter  Type  G, 

Flight  Condition  8 F-82 

F-107  Phase  and  Gain  Margin,  Aileron  Loop,  Filter  Type  G, 

Flight  Condition  8 F-82 

F-108  Phase  and  Gain  Margin,  Elevator  Loop,  Filter  Type  H, 

Flight  Condition  5 F-83 

F-109  Phase  and  Gain  Margin,  Aileron  Loop,  Filter  Type  H, 

Flight  Condition  5 F-83 

F-110  Phase  and  Gain  Margin,  Elevator  Loop,  Filter  Type  H, 

Flight  Condition  6 F-84 

F-111  Phase  and  Gain  Margin,  Aileron  Loop,  Filter  Type  H, 

Flight  Condition  6 F-84 

F-112  Phase  and  Gain  Margin,  Elevator  Loop,  Filter  Type  H, 

Flight  Condition  7 . . ■ F-85 

F-113  Phase  and  Gain  Margin,  Aileron  Loop,  Filter  Type  H, 

Flight  Condition  7 . F-85 

F-114  Phase  and  Gain  Margin,  Elevator  Loop,  Filter  Type  H, 

Flight  Condition  8 F-86 

F-115  Phase  and  Gain  Margin,  Aileron  Loop,  Filter  Type  H, 

Flight  Condition  8 F-86 

F-116  Power-Spectral-Density  Plot,  Flight  Condition  5 

(Elevator  Displacement) F-88 

F-117  Power-Spectral-Density  Plot,  Flight  Condition  5 

(Elevator  Rate) F-88 

F-118  Power-Spectral-Density  Plot,  Flight  Condition  5 

(Aileron  Displacement) F-89 

F-119  Power-Spectral-Density  Plot,  Flight  Condition  5 

(Aileron  Rate) F-89 

F-120  Power-Spectral-Density  Plot,  Flight  Condition  6 

(Elevator  Displacement) F-90 

F-121  Power-Spectral-Density  Plot,  Flight  Condition  6 

(Elevator  Rate) F-90 
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F-122  Power-Spectral-Density  Plot,  Flight  Condition  6 

(Aileron  Displacement) F-91 

F-123  Power-Spectral-Density  Plot,  Flight  Condition  6 

(Aileron  Rate)  F-91 

F-124  Power-Spectral-Density  Plot,  Flight  Condition  7 

(Elevator  Displacement) F-92 

F-125  Power-Spectral-Density  Plot,  Flight  Condition  7 

(Elevator  Rate) F-92 

F-126  Power-Spectral-Density  Plot,  Flight  Condition  7 

(Aileron  Displacement) F-93 

F-127  Power-Spectral-Density  Plot,  Flight  Condition  7 

(Aileron  Rate) F-93 

F-128  Power-Spectral-Density  Plot,  Flight  Condition  8 

(Elevator  Displacement) F-94 

F-129  Power-Spectral-Density  Plot,  Flight  Condition  8 

(Elevator  Rate) F-94 

F-130  Power-Spectral-Density  Plot,  Flight  Condition  8 

(Aileron  Displacement) F-95 

F-131  Power-Spectral-Density  Plot,  Flight  Condition  8 

(Aileron  Rate) F-95 

F-132  Response  of  Inboard  Shear  (tj  = 0.25)  to  a Discrete 

(1-cos)  Gust,  Flight  Condition  1,  Time  History 

Simulation . F-96 

F-133  Response  of  Inboard  Bending  Moment  (tj  = 0.25)  to  a 

Discrete  (1-cos)  Gust,  Flight  Condition  1,  Time 

History  Simulation F-97 

F-134  Response  of  Inboard  Torsion  (tj  = 0.25)  to  a 

Discrete  (1-cos)  Gust,  Flight  Condition  1,  Time 

History  Simulation F-98 

F-135  Response  of  Outboard  Shear  (t?  = 0.75)  to  a 

Discrete  (1-cos)  Gust,  Flight  Condition  1,  Time 

History  Simulation F-99 
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F-136  Response  of  Outboard  Bending  Moment  (t?  = 0.75) 

to  a Discrete  (1-cos)  Gust,  Flight  Condition  1, 

Time  History  Simulation F-lOO 

F-137  Response  of  Outboard  Torsion  (i?  = 0.75)  to 

a Discrete  (1-cos)  Gust,  Flight  Condition  1, 

Time  History  Simulation F-101 

F-138  Response  of  Elevator  Deflection  to  a Discrete 
(1-cos)  Gust,  Flight  Condition  1,  Time  History 

Simulation F-102 

F-139  Response  of  Elevator  Rate  to  a Discrete  (1-cos) 

Gust,  Flight  Condition  1,  Time  History  Simulation F-102 

F-1^0  Response  of  Outboard  Aileron  Deflection  to  a 

Discrete  (1-cos)  Gust,  Flight  Condition  1, 

Time  History  Simulation  F-103 

F-l^tl  Response  of  Outboard  Aileron  Rate  to  a Discrete 

(1-cos)  Gust,  Flight  Condition  1,  Time  History 

Simulation F-103 

F-142  Response  of  Inboard  Shear  (17  = 0.25)  to  a 

Discrete  (1-cos)  Gust,  Flight  Condition  2, 

Time  History  Simulation F-104 

F-143  Response  of  Inboard  Bending  Moment  (17  = 0.25) 

to  a Discrete  (1-cos)  Gust,  Flight  Condition  2, 

Time  History  Simulation F-105 

F-144  Response  of  Inboard  Torsion  (t?  = 0.25)  to  a 

Discrete  (1-cos)  Gust,  Flight  Condition  2, 

Time  History  Simulation F-106 

F-145  Response  of  Outboard  Shear  (t?  = 0.75)  to  a 

Discrete  (1-cos)  Gust,  Flight  Condition  2, 

Time  History  Simulation F-107 

F-146  Response  of  Outboard  Bending  Moment  (j?  = 0.75) 

to  a Discrete  (1-cos)  Gust,  Flight  Condition  2, 

Time  History  Simulation F-108 
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F-147  Response  of  Outboard  Torsion  (tj  = 0.75)  to  a 

Discrete  (1-cos)  Gust,  Flight  Condition  2, 

Time  History  Simulation F-109 

F-148  Response  of  Elevator  Deflection  to  a Discrete 

(1 -cos)  Gust,  Flight  Condition  2,  Time  History 

Simulation F-110 

F-149  Response  of  Elevator  Rate  to  a Discrete  (1-cos) 

Gust,  Flight  Condition  2,  Time  History  Simulation F-110 

F-150  Response  of  Outboard  Aileron  Deflection  to  a 

Discrete  (1-cos)  Gust,  Flight  Condition  2, 

Time  History  Simulation  F-1 1 1 

F-151  Response  of  Outboard  Aileron  Rate  to  a Discrete 

(1-cos)  Gust,  Flight  Condition  2,  Time  History 

Simulation F-1 11 

F-1 52  Response  of  Inboard  Shear  (77  = 0.25)  to  a 

Discrete  (1-cos)  Gust,  Flight  Condition  3, 

Time  History  Simulation F-1 12 

F-1 53  Response  of  Inboard  Bending  Moment  (17  = 0.25) 

to  a Discrete  (1-cos)  Gust,  Flight  Condition  3, 

Time  History  Simulation F-1 13 

F-1 54  Response  of  Inboard  Torsion  (77  = 0.25)  to  a 

Discrete  (1-cos)  Gust,  Flight  Condition  3,  Time 

History  Simulation F-1 14 

F-1 55  Response  of  Outboard  Shear  (t?  = 0.75)  to  a 

Discrete  (1-cos)  Gust,  Flight  Condition  3, 

Time  History  Simulation F-1 15 

F-1 56  Response  of  Outboard  Bending  Moment  (77  = 0.75) 

to  a Discrete  (1-cos)  Gust,  Flight  Condition  3, 

Time  History  Simulation F-1 16 

F-1 57  Response  of  Outboard  Torsion  (77  = 0.75)  to  a 

Discrete  (1-cos)  Gust,  Flight  Condition  3, 

Time  History  Simulation F-1 17 
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F-158  Response  of  Elevator  Deflection  to  a Discrete 

(1-cos)  Gust,  Flight  Condition  3,  Time  History 

Simulation F-118 

F-159  Response  of  Elevator  Rate  to  a Discrete  (1-cos) 

Gust,  Flight  Condition  3,  Time  History  Simulation F-118 

F-160  Response  of  Outboard  Aileron  Deflection  to  a 

Discrete  (1-cos)  Gust,  Flight  Condition  3, 

Time  History  Simulation F-119 

F-161  Response  of  Outboard  Aileron  Rate  to  a Discrete 

(1-cos)  Gust,  Flight  Condition  3,  Time  History 

Simulation  F-119 

F-162  Response  of  Inboard  Shear  (i?  = 0.25)  to  a 

Discrete  (1-cos)  Gust,  Flight  Condition  4, 

Time  History  Simulation F-120 

F-163  Response  of  Inboard  Bending  Moment  (i?  = 0.25) 

to  a Discrete  (1-cos)  Gust,  Flight  Condition  4, 

Time  History  Simulation F-121 

F-16^  Response  of  Inboard  Torsion  (v  = 0.25)  to  a 

Discrete  (1-cos)  Gust,  Flight  Condition  k, 

Time  History  Simulation F-122 

F-165  Response  of  Outboard  Shear  (t?  = 0.75)  to  a 

Discrete  (1-cos)  Gust,  Flight  Condition  k, 

Time  History  Simulation F-123 

F-166  Response  of  Outboard  Bending  Moment  (tj  = 0.75) 

to  a Discrete  (1-cos)  Gust,  Flight  Condition  k, 

Time  History  Simulation F-124 

F-167  Response  of  Outboard  Torsion  (tj  = 0,75)  to  a 

Discrete  (1-cos)  Gust,  Flight  Condition  4,  Time 

History  Simulation F-125 

F-168  Response  of  Elevator  Deflection  to  a Discrete 

(1-cos)  Gust,  Flight  Condition  4,  Time  History 

Simulation F-126 
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F-169  Response  of  Elevator  Rate  to  a Discrete  (1-cos) 

Gust,  Flight  Condition  4,  Time  History  Simulation F-126 

F-170  Response  of  Outboard  Aileron  Deflection  to  a 

Discrete  (1-cos)  Gust,  Flight  Condition  4,  Time 

History  Simulation F-127 

F-171  Response  of  Outboard  Aileron  Rate  to  a Discrete 

(1-cos)  Gust,  Flight  Condition  4,  Time  History 

Simulation F-127 

F-172  Response  of  Elevator  Deflection  to  a Discrete 

(1-cos)  Gust,  Flight  Condition  5,  Time  History 

Simulation F-128 

F-173  Response  of  Elevator  Rate  to  a Discrete  (1-cos) 

Gust,  Flight  Condition  5,  Time  History  Simulation F-128 

F-174  Response  of  Outboard  Aileron  Deflection  to  a 

Discrete  (1-cos)  Gust, -Flight  Condition  5,  Time 

History  Simulation F-129 

F-175  Response  of  Outboard  Aileron  Rate  to  a Discrete 

(1-cos)  Gust,  Flight  Condition  5,  Time  History 

Simulation F-129 

F-176  Response  of  Elevator  Deflection  to  a Discrete 

(1-cos)  Gust,  Flight  Condition  6,  Time  History 

Simulation F-130 

F-177  Response  of  Elevator  Rate  to  a Discrete  (1-cos) 

Gust,  Flight  Condition  6,  Time  History  Simulation F-130 

F-178  Response  of  Outboard  Aileron  Deflection  to  a 

Discrete  (1-cos)  Gust,  Flight  Condition  6,  Time 

History  Simulation F-131 

F-179  Response  of  Outboard  Aileron  Rate  to  a Discrete 

(1-cos)  Gust,  Flight  Condition  6,  Time  History 

Simulation F-131 
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F-180  Effect  of  Actuator  Nonlinearities  on  Incremental 

Inboard  Bending  Moment  (17  = 0.25),  Flight 

Condition  1 F-133 

F-181  Effect  of  Actuator  Nonlinearities  on  Incremental 

Inboard  Torsion  (tj  = 0.25),  Flight  Condition  1 F-133 

F-182  Effect  of  Actuator  Nonlinearities  on  Incremental 
Outboard  Bending  Moment  (tj  = 0.75),  Flight 

Condition  1 F-134 

F-183  Effect  of  Actuator  Nonlinearities  on  Incremental 

Outboard  Torsion  (t1  = 0.75),  Flight  Condition  1 F-134 

F-18^  Effect  of  Actuator  Nonlinearities  on  Incremental 

Inboard  Bending  Moment  (t?  = 0.25),  Flight 

Condition  2 F-135 

F-185  Effect  of  Actuator  Nonlinearities  on  Incremental 

Inboard  Torsion  (“n  = 0.25),  Flight  Condition  2 F-135 

F-186  Effect  of  Actuator  Nonlinearities  on  Incremental 

Outboard  Bending  Moment  (tj  = 0.75),  Flight 

Condition  2 F-136 

F-187  Effect  of  Actuator  Nonlinearities  on  Incremental 

Outboard  Torsion  (tj  = 0.75),  Flight  Condition  2 F-136 

F-188  Effect  of  Actuator  Nonlinearities  on  Incremental 

Inboard  Bending  Moment  (tj  = 0.25),  Flight 

Condition  3 F-137 

F-189  Effect  of  Actuator  Nonlinearities  on  Incremental 

Inboard  Torsion  (tj  = 0.25),  Flight  Condition  3 F-137 

F-190  Effect  of  Actuator  Nonlinearities  on  Incremental 
Outboard  Bending  Moment  (t?  = 0.75),  Flight 

Condition  3 F-138 

F-191  Effect  of  Actuator  Nonlinearities  on  Incremental 

Outboard  Torsion  (tj  = 0.75),  Flight  Condition  3 F-138 
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F-192  Effect  of  Actuator  Nonlinearities  on  Incremental 

Inboard  Bending  Moment  (ti  = 0.25),  Flight 

Condition  4 F-139 

F-193  Effect  of  Actuator  Nonlinearities  on  Incremental 

Inboard  Torsion  (t)  = 0.25),  Flight  Condition  4 F-139 

F-194  Effect  of  Actuator  Nonlinearities  on  Incremental 

Outboard  Bending  Moment  (tj  = 0.75), 

Flight  Condition  4 F-140 

F-195  Effect  of  Actuator  Nonlinearities  on  Incremental 

Outboard  Torsion  (tj  = 0.75),  Flight  Condition  4 F-140 
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APPENDIX  A:  CRUCIAL  FUNCTION  CONFIGURATION  FOR  RELIABILITY 


APPENDIX  A:  CRUCIAL  FUNCTION  CONFIGURATION  FOR  RELIABILITY 


To  meet  the  reliability  requirements  of  the  Essential  Pitch-Augmented  Stability  (PAS) 
function  in  the  Integrated  System,  it  was  necessary  to  select  a level  of  redundancy,  a 
configuration,  and  the  components  for  this  function.  The  reliability  requirements  for  the 
other  Active  Controls  Technology  (ACT)  functions,  which  are  less  severe,  would  also  be 
met  by  this  configuration. 

RELIABILITY  PREDICTION  FOR  THE  ALTERNATIVE  CONFIGURATIONS 

The  reliability  prediction  for  the  three  initially  selected  system  configurations  was  made 
with  the  computer-aided  redundant  system  reliability  analysis  (CARSRA)  computer 
program  (see  app  B,  subsec  B.1.0),  and  software  reliability  and  coverage  were  neglected. 

The  component  failure  rates  used  in  this  set  of  predictions  were  the  preliminary  estimates 
of  the  values  to  be  expected;  no  allowances  were  made  for  airplane  interconnect  wiring  or 
connector  unreliability.  The  failure  rates  so  obtained  are  not  compatible  with  later 
calculations  but  are  entirely  adequate  to  show  the  relative  merits  of  the  several  versions. 
Table  A-1  shows  the  calculated  failure  rates  for  three  configurations  and  five  cases 
evaluated.  The  configurations  and  cases  in  Table  A-1  are  defined  as  follows: 

Configuration  1 Quadruple  redundancy;  hardwired  cross  strapping  of  sensor  outputs; 

only  Q sensors  (short-period  PAS);  no  computer  intercommu- 
nication; sensor  voting  within  each  computer 

Configuration  2 Same  as  configuration  1,  except  that  hardwired  cross  strapping  is 

replaced  with  computer  cross-channel  communication 

Configuration  3 Same  as  configuration  2,  except  that  electronic  voting  (X  = 71.4  x 

-6 

10  per  flight  hour  failure  rate)  is  inserted  between  computers  and 
actuators 
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Notes:  1 . Figures  indicate  short-period  PAS  reliability  as  probability  of  failure  per  1-hr  flight  3.  Table  shows  probability  of  function  loss  during  a 1-hr  flight 

given  that  software  reliability  and  coverage  are  neglected.  assuming  fault-free  software  and  coverage  =■  1 .0. 

2.  Failure  rates  (X)  of  components  per  lO^hr. 


Case  A 


Four  Q sensors  based  on  inertial  reference  system  (IRS);  computers 
with  failure  rates,  X = 250  x 10"^  each  per  flight  hour 

Four  mechanical  secondary  actuators  (failure  rate,  X = 31.6  x 10"^ 
each  per  flight  hour) 

Three  hydraulic  systems  (failure  rate,  X = 25  x 10"^  each  per  flight 
hour) 

Case  B Same  as  case  A,  except  three  mechanical  secondary  actuators  plus 

one  mathematical  model 

Case  C Same  as  case  B,  except  three  IRS-based  Q sensors  and  one 

dedicated  Q sensor 

Case  D Same  as  case  C,  except  all  dedicated  Q sensors 

Case  E Same  as  case  D,  but  using  a more  reliable  computer  (failure 

rate,  X = 167  x 10"^  per  flight  hour) 

As  shown  in  Table  A-1  (under  stated  analysis  assumptions),  all  three  configurations  meet 
the  reliability  requirements.  Configuration  2,  case  C in  Table  A-1,  was  selected  for  the 
Integrated  System  after  considering  system  implementation  complexity  and  reliability. 

A similar  study  was  conducted  to  investigate  the  feasibility  of  triply  redundant  channels. 
The  results  are  shown  in  Table  A-2.  No  version  of  the  triply  redundant  PAS  meets  the 
requirements. 

Table  A-1  shows  that  when  sensors  and  computers  have  high  reliability,  cross  strapping 
between  the  sensors  and  computers  has  little  effect.  The  same  is  observed  for  a system 
with  a voter  between  the  computers  and  the  actuators.  It  is  not  expected  that  any 
foreseeable  improvement  in  component  reliability  will  permit  the  triply  redundant  crucial 
PAS  system  to  meet  the  requirements. 
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Requirements: 

At  least  2 

At  least  2 

At  least  2 

-{ 

Sensor  Computer 

Secondary 

actuator 

Table  A-2.  Three-Channel  Configuration  Comparison 


3 actuators  -f  1 mathematical  model 


2 actuators  -i- 1 mathematical  model 


Case  A:  Case  B:  Case  C:  Case  D: 

3 IRS  Q sensors  3 dedicated  Q sensors  3 IRS  Q sensors  3 VYRO  sensors 

3 computers  3 computers  3 computers  3 computers 

3 hardware  actuators  3 hardware  actuators  2 hardware  actuators  2 hardware  actuators 

1 mathematical  model  1 mathematical  model  1 mathematical  model  1 mathematical  model 


Configuration  6 


Note:  Figures  indicate  probability  of  function  loss  during  a 1-hr  flight  neglecting  software 

reliability  and  coverage. 
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APPENDIX  B;  RELIABILITY  MODELING  METHODS 


B.I.O  CARSRA  PROGRAM 

Reliabilities  of  the  alternative  Essential  Pitch-Augmented  Stability  (PAS)  configurations 
were  determined  with  the  aid  of  the  computer-aided  redundant  system  reliability  analysis 
(CARSRA)  computer  program,  which  was  developed  during  the  NASA-Boeing  Airborne 
Advanced  Reconfigurable  Computer  System  (ARCS)  Program  (ref  B-1). 

The  CARSRA  computer  program  was  designed  for  and  is  particularly  suited  to  systems 
with  redundant  stages,  which  it  defines  as  "sets  of  identical  redundant  modules." 
CARSRA  can  accommodate  complicated  systems  because  it  splits  them  into  stages  and 
uses  stage  Markov  diagrams,  instead  of  the  Markov  diagram  of  the  entire  system,  to 
develop  the  logic.  Because  all  components  in  a stage  are  identical  by  definition,  there  is 
no  need  to  distinguish  which  module  fails  first,  which  second,  and  so  forth.  For  systems 
with  a set  of  redundant  modules  performing  the  same  function  but  having  different  failure 
rates,  the  program  adaptability  is  limited.  The  program  also  makes  some  approximations; 
e.g.,  it  truncates  calculations  of  dependency-stage  failures  at  two  module  failures 
(extendable  to  three  in  the  high-accuracy  mode).  This  may  not  always  provide  enough 
accuracy. 

An  example  of  a CARSRA  reliability  calculation  is  the  Active  Controls  Technology  (ACT) 
function  shown  as  a block  diagram  in  Figure  B-1.  This  is  a redundant  system  with  three 
velocity  inputs  from  the  digital  air  data  computer  (DADC),  three  control  column  force 
sensor  inputs,  three  pitch-rate  inputs  from  the  inertial  reference  system  (IRS),  and  one 
pitch-rate  input  from  a dedicated  pitch-rate  sensor.  There  are  three  mechanical 
actuators  and  a mathematical  model  of  an  actuator  simulated  in  each  computer.  At  least 
two  of  each  kind  of  component  must  be  functional  or  the  system  is  considered  to  have 
failed.  All  sensors  and  actuators  are  connected  to  and  dependent  upon  the  four 
computers.  This  dependency  means  that  the  loss  of  one  computer  results  in  loss  of  the 
sensors  and  actuator  in  that  channel.  Each  actuator  is  also  dependent  upon  its  hydraulic 
power  source,  but  in  this  problem  a single  failure  rate  was  used  for  each  actuator  and  its 
hydraulic  system.  If  realistically  different  failure  rates  for  the  three  hydraulic  systems 
had  been  assumed,  CARSRA  could  not  have  handled  this  prediction. 
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'Mathematical  model  is  implemented  in  four  computers. 


Figure  B-1.  Block  Diagram  for  an  ACT  Function 


The  mathematical  model  of  Figure  B-1  is  not  actual  hardware,  but  a computed  simulation 
assumed  to  be  perfectly  reliable.  For  this  prediction,  the  mechanical  voter  is  also 
assumed  to  be  perfectly  reliable. 

Figure  B-2  numbers  the  components  according  to  stage  and  channel.  For  example,  the 
third-channel  velocity  sensor  is  number  223  (stage  22,  channel  3).  A dependency  matrix 
composed  of  these  numbers,  as  shown  in  Figure  B-2,  is  entered  into  the  computer. 

Each  computer,  velocity  sensor,  or  column  force  sensor  set  is  identified  as  a stage.  In  the 
CARSRA  model,  however,  a stage  must  consist  of  identical  redundant  components,  so  the 
Q sensors  (one  of  which  is  different)  cannot  be  considered  to  be  one  stage.  CARSRA 
permits  listing  each  Q sensor  as  a stage  and  declaring  in  another  matrix  which  of  these 
stages  may  be  permitted  to  fail  without  system  loss.  In  this  instance,  all  combinations  of 


B-2 


Q sensors  taken  two  or  fewer  at  a time  (11  combinations)  must  be  listed.  The 
mathematical  model  and  the  real  actuators  also  have  different  failure  rates,  but  because 
the  mathematical  model  was  considered  perfectly  reliable,  the  requirement  for  at  least 
two  working  components  in  the  stage  may  be  restated  as  "at  least  one  working  real 
actuator."  Had  it  been  necessary  to  apply  the  technique  used  on  the  Q sensors,  this 
problem  would  have  been  beyond  the  capability  of  CARSRA. 

The  heart  of  the  CARSRA  process  is  the  ability  to  use  several  simple  stage  Markov 

models  instead  of  one  system  Markov  model.  In  Figure  B-3,  the  circled  numbers  represent 

states.  The  numbers  at  the  bottom  of  each  diagram  indicate  system  failure  state  and 

hidden  failure  state.  The  transition  rates,  X , represent  the  transition  (failure)  rate 

n mp 

between  the  state  m and  p for  stage  n.  Table  B-1  lists  the  values  for  these  transitions. 
These  values  are  the  main  data  entries  to  CARSRA. 


*AL-2  *AL-2  *AL-2 

r " > 

Stage  21  Stage  22  Stage  23 


Stage  26 


Figure  B-2.  Dependency  Diagram  and  Matrix  for  Function  in  Figure  B-1 


B-3 


Stage  1 
computers 


Stage  21 
actuators 
(including 
hydraulics) 


Stage  22 
V sensor 


Stage  23  Stages  24,  25,  and  26 

sensor  IRS  Q sensors 


Figure  B-3.  Stage  Markov  Models 


Table  B-1.  State  Transition  Rates 


Stage 

Failure  rate 
per  10®  hr 

Xl2 

^23 

^34 

^35  or  ^13 
or  ^24 

1 

Computers 

150.6 

602.0 

452.0 

301.0 

0 

21 

Actuator  and  hydraulics 

38.6 

201.6 

134.4 

67.2 

0 

22 

V sensors 

85.0 

250.0 

170.0 

0 

23 

sensors 

13.6 

41.0 

B 

0 

24,25,26 

IRS  Q sensors 

418.0 

418.0 

n 

0 

27 

Dedicated  Q sensors 

9.86 

9.86 

B 

0 
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B.2.0  FTREE  PROGRAM 


B.2.1  REQUIREMENT  FOR  AN  IMPROVED  SOLUTION 

The  ACT  systems  are  composed  of  so  many  parts  with  multiple  interconnections  and 
multiple-occurring  events  that  manual  calculation  of  system  reliabilities  is  not  practical. 
Early  studies  in  Active  Controls  Technology  (ref  B-2)  were  accomplished  with  CARSRA. 
The  limited  capacity  of  CARSRA  required  a change  to  another  program,  FTREE  (fault 
tree),  developed  at  The  Boeing  Company.  The  advantages  of  this  program  will  be 
apparent  in  the  following  example  of  its  use. 

B.2.2  FTREE  REQUIREMENTS  AND  METHODS 

Inputs  to  FTREE  are  derived  from  a reliability  fault  tree  model  for  the  system  under 
consideration.  The  tree  is  built  from  standard  logic  symbols  and  the  shorthand  symbols 
shown  and  defined  in  Figure  B-4.  Fault  trees  for  all  ACT  functions  are  drawn  in  the 
standard  format  (see  fig.  B-5).  The  input  events  are  numbered  in  a consecutive  series, 
each  event  having  the  same  number  wherever  it  appears.  There  may  be  no  more  than 
1000  input  events.  Starting  with  a number  greater  than  the  last  input  event,  the  logic 
gates  are  then  numbered  in  a consecutive  series  with  the  requirement  that  no  gate  may 
feed  into  a lower  numbered  gate.  A logic  gate  may  be  multiple  occurring  if  no  other 
multiple-occurring  event  or  logic  gate  is  an  input  to  it.  Should  such  a combination  occur, 
it  is  possible  to  assign  a different  number  to  the  higher  gate  wherever  it  occurs.  The 
maximum  number  of  gates  and  input  events  combined  may  not  exceed  2000.  Normally, 
the  number  of  multiple-occurring  events  is  limited  to  70.  That  number  can  be  increased, 
but  numbers  above  about  50  become  expensive  to  run.  The  highest  sequentially  numbered 
logic  gate,  referred  to  as  the  top  gate  in  any  function,  represents  failure  of  that  function. 
The  computer  program  calculates  the  probability  of  failure  for  the  output  of  each  gate, 
including  the  top  gate,  which  represents  failure  of  the  function. 

A system  fault  tree  can  be  composed  of  all  the  individual  ACT  function  fault  trees  if  the 
gates  are  numbered  in  one  continuous  sequence.  This  offers  several  advantages;  e.g., 
evaluation  of  the  probabilities  of  combinations  of  functions.  Figure  B-5  illustrates,  in  a 
condensed  form,  such  a combination.  The  lowest  gates  are  all  the  top  gates  of  single  ACT 
functions  and  actually  represent  an  entire  fault  tree  of  that  function  with  all  its  input 
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Gate  name  Code  Symbol 

AND  A Q 

P(I)  = P1.P2* PN 

OR  0 ^ 

P(l)=1-  (1-P1H1-P2)  ...  (1-PN) 


Remarks 

All  of  two  or  more  failures  must  occur  to  fail  next  higher  event 


Any  one  or  more  of  a number  of  failure  events  will  cause  next 
event  to  fail. 


CONDITIONAL-SEQUENTIAL-AND 

C 

P(I)  = P1.P2 PN 

N! 

where  N = number  of  input  events 
STANDBY  S (?) 

P(l)  = P1*P4+(P1*P2+P1*P3*+P2*P5+ 
P3*P5)/2.0 


Mof  N M 


P{l)  is  calculated  by  a summing  of  the 
minterm  probabilities 


All  of  two  or  more  failure  events  must  occur  in  a specific 
sequence  to  fail  next  event 


To  fail  next  event,  five  failure  events  must  be  considered  as 
follows; 

1.  Active  component  fails  during  operation 

2.  Passive  component  fails  during  standby 

3.  Passive  component  fails  during  operation 

4.  Switching  device  fails  to  switch 

5.  Switching  device  inadvertently  switches 

(A  zero  probability  of  failure  may  be  assigned  to  any  of  these 
input  event  probabilities.  The  logic  statement  in  the  data  file 
must  list  the  input  events  in  the  precise  order  stated  here.) 

Failure  of  any  "m"  or  more  of  "n"  input  failure  events  will  fail 
the  next  event;  e.g.,  m=2,  n=3;  thus,  any  two  of  the  three  inputs, 
"n"  may  not  exceed  20. 


EXCLUSIVE  OR 


In  FTREE  this  condition  is  best  modeled  by  using  an  "OR," 
an  "AND,"  and  an  INVERT  gate. 


P(l)  = PI  + P2  * PI 
INVERT  V 

P(l)  = 1-PI 
INPUT  I 

P(l)=  PI 


The  next  event  probability  is  one  minus  the  failure  event 
probability. 

O The  failure  probability  fed  into  the  model  in  the  form  of  a 

failure  rate  and  time  or  directly  as  a probability. 

Figure  B-4.  Fault  Tree  Logic  Symbols 
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Diversion 


PAS  inoperative 


■ yaw  wi 

one  failure  from 
inoperative 


Top  gate  of 
WLA  inoperative 


Figure  B-5.  Fault  Tree  for  the  Probability  of  Diversion  Upon  One  Failure 
Away  From  Function  Loss 


events.  In  this  way,  the  computer  model  can  take  account  of  multiple-occurring  events 
throughout  the  tree. 

Excerpts  from  a typical  input  file  for  the  FTREE  program,  including  all  ACT  functions, 
are  shown  in  Figure  B-6. 
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REDACT  DATA  ALL  FUNCTIONS  8 20  80— Name  and  date  of  file 

1 2 — — — Option  1,  failure  combinations  taken  two  at  a time 

10  119  200  386  1 » D— 6 200 —10  through  1 19  are  input  events,  200  through  386  are  logic  gates 
^ All  failure  rates  times  10'®  per  hr 

1 ' Specified  multiple-occurring  events;  none 

■Time  (flight  duration) 


10 

2 1' 

11 

2 1 

12 

2 1 

13 

2 1 

14 

35.9 

r 

15 

35.9 

1 

16 

35.9 

1 

17 

35.9 

1. 

18 

29.6 

1 ■ 

19 

29.6 

1 

20 

29.6 

1 

21 

29.6 

1 . 

29.6 

1 ' 

23 

29.6 

1 

24 

29.6 

1 

25 

29 . 6 

1. 

26 

38.6 

1 ’ 

27 

38.6 

1 

28 

38.6 

1 

29 

37.4 

n 

30 

37.4 

ij 

31 

50  1 

32 

50  1 

Actuators,  aileron,  outboard  inner  segment;  failure  rate 
2 X 10‘®/hr;  exposure  = 1 hr  (two  left  and  two  right) 


Actuators,  aileron,  outboard  outer  segment;  failure  rate 
35.9  X 10'6/hr;  exposure  = 1 hr  (two  left  and  two  right) 


Actuators,  flaperon,  inboard;  failure  rate  29.6  x 10'6/hr; 
exposure  = 1 hr  (two  left  and  two  right) 


Actuators,  flaperon,  outboard;  failure  rate  29.6  x 10'6/hr; 
exposure  = 1 hr  (two  left  and  two  right) 


Actuators,  elevator,  secondary;  failure  rate 
38.6  x 1 0*6/hr;  exposure  = 1 hr 

Actuators,  rudder,  secondary;  failure  rate  37.4  x 10'6/hr; 
exposure  = 1 hr 

Actuators,  stick  pusher;'failure  rate  50.0  x 1 0•6^r;  exposure  = 1 hr 


116 

117 

118 
119 
200 
201 
202 

203 

204 


OOw 

384 

385 

386 
EOF: 

e;> 


11  1 
13.6 
13.6 
13.6 
0 49 


50 

51 


1 
1 
1 

52 

53 

54 


Last  input  events 

— First  gates 

77  80  831 

78  81  84 

79  82  85 


2 200  201  202 


Three  DADC  velocity  functions  made  up  of  primary  computer  input  set  OR 
primary  computer  common  parts  OR  sensor  dynamic  pressure  OR  DADC 
computer  parts 

Velocity  from  three  DADC-at  least  two  must  fail  for  signal  to  be  lost 


0 

0 


49  52  86  89 

50  53  87 


95 


98 


Pitch  angles  computer  input  set  OR  computer  common  parts  OR  IRS  pitch 
rate  analog  OR  IRS  yaw  rate  OR  IRS  remaining  parts  (computer)iOR  IRS 
common  parts 


A 

38.1 

o82 

383 

0 

375 

380 

384 

0 

235 

265 

.323 

Elevator  actuation;  three  secondary  actuation  top  gate  "AND'ed"  together 
Essential  PAS;  Q sensors,  computers,  and  elevator  actuation  "OR'ed"  together 
Top  gate.  Full  PAS  OR  LAS  OR  FMC  failed 


Figure  B-6.  Typical  Fault  Tree  Input  File 
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Figure  B-7  shows  how  the  computer  prints  out  successive  approximations  to  the  top  gate 
reliability  and  prompts  the  user  about  options  when  the  operation  is  accomplished  in  the 
interactive  mode  on  a terminal.  In  the  illustrated  instance,  because  the  problem  was 
familiar,  the  operator  elected  to  bypass  option  1,  which  provides  an  inexpensive 
troubleshoot  of  the  entry  file,  and  went  directly  to  option  3.  This  option,  in  addition  to 
giving  failure  rates  at  all  logic  gates,  causes  the  computer  to  print  out  sensitivities  of  the 
top  gate  to  all  multiple-occurring  events.  The  computer  calculates  the  failure  probability 
of  the  top  gate  (the  last  gate  in  fig.  B-6)  truncated  at  combinations  of  failed  components 
taken  up  to  two  at  a time,  as  previously  selected  in  line  2 of  the  control  block.  Figure  B-6. 
It  then  informs  the  operator  that  the  solution  is  still  converging  on  the  true  answer,  asks 
if  combinations  up  to  three  at  a time  should  be  tried,  and  displays  a number  of  computer 
service  units  (CSU)  accumulated  in  the  session.  C5Us  are  a measure  of  the  cost  of 
running  the  program  and  enable  the  user  to  estimate  the  cost  of  running  additional  failure 
combinations.  In  this  instance,  another  combination  was  authorized,  but  an  opportunity  to 
assess  four  combinations  was  turned  down.  The  total  output  was  then  printed  out  at  a 
remote  terminal. 

Figure  B-8  shows  excerpts  from  the  remote  terminal  printout  of  the  FTREE  results, 
annotated  to  show  the  identity  of  the  logic  gates  and  input  events.  Each  output  event 
represents  a logic  gate  in  the  combined  fault  tree  of  all  ACT  functions.  The  top  gate,  an 
OR  gate,  selects  Full  PAS,  lateral/directional-augmented  stability  (LAS),  and  flutter- 
mode control  (FMC)  and  combines  them  to  show  the  probability  that  any  one  or  more  of 
the  functions  will  become  inoperable  in  a 1-hr  flight.  This  represents  the  probability  of 
having  to  institute  a flight  restriction  while  in  flight. 

A notable  advantage  of  FTREE  is  that,  in  one  computer  run,  not  only  the  top  gate 
reliability  but  many  other  reliabilities  are  displayed.  For  example,  opposite  gate  235  is 
the  probability  that  Full  PAS  will  fail.  Within  Full  PAS,  gate  203  is  the  probability  that 
the  airspeed  output  signals  from  three  DADCs  will  be  reduced  to  fewer  than  two  signals. 
Gate  208  gives  the  probability  that  both  the  DADCs  and  their  backup  function  (pitch  angle 
from  the  IRS)  will  be  reduced  below  the  minimum  two  outputs.  Gate  226  gives  the 
probability  that  the  Full  PAS  function  will  fail  for  loss  of  some  sensor  input.  It  is 
apparent  that  such  information  can  be  useful  in  design  optimization. 
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OFTREE 


FTREE(FAULT  TREE)  PROGRAM 
VERSION  A.l 

ENTER  INPUT  FILENAME  AND  FILETYPE. 

>REVACT  DATA 
EXECUTION  BEGINS... 

IF  YOU  WANT  TO  CHANGE  THE  OPTION  ENTER  OPTION  NUMBER(lf2  OR  3) 
<IF  YOU  WANT  TO  KEEP  OPTION  SPECIFIED  IN  THE  INPUT  FILE»  HIT  CR) 


>3 


FAILURE 

UNRELIABILITY  RELIABLITY 

GATE 

CSU 

1 

1.094D-07 

0 . 9999998905774120 

386 

87 

2 

5.972D-07 

0 . 9999994028494359 

386 

494 

THE  DIFFERENCE  BETWEEN  2 FAILURES  AND  1 FAILURES  IS  GREATER  THAN  l.D-13 
DO  YOU  WANT  TO  RUN  ANOTHER  FAILURE  COMBINATION? 

>YES 

3 S.978D-07  0.9999994022342390  386  7650 

THE  DIFFERENCE  BETWEEN  3 FAILURES  AND  2 FAILURES  IS  GREATER  THAN  l.D-13 
DO  YOU  WANT  TO  RUN  ANOTHER  FAILURE  COMBINATION? 

>N0 

DO  YOU  WANT  THE  ANALYSIS  OUTPUT  TO  : 

1.  THE  TERMINAL  - TYPE  'PRINT' 

2.  A FILE  - TYPE  'FILE' 

3.  BOTH  - TYPE  'BOTH' 

>2 

PLEASE  ENTER  FILENAME  FILETYPE  FOR  YOUR  OUTPUT  FILE. 

>DDD  DATA 

DO  YOU  WANT  TO  MAKE  ANOTHER  RUN? 

('YES'  OR  'NO') 

>N0 

Rf 

OSPOOL  PRINTER  TO  RIO  DIST  REMOTE  0 3 CONT 

Figure  B-7.  Interactive  Terminal  Printout 
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REVACT  DATA  ALU  ^UNCTIONS  8 20  80 


OPTION 


FLIGHT 

INPUT 

?:vE;Ar 


OUTPUT 

rW£NT 

200 

201 

202 

203 

20% 

205 

206 

207 

208 
20’ 
213 
21 1 
212 
215 

21  A 
215 

21b 

217 

21S 

2H 

22} 

2?1 

22  2 
223 
2?% 

225 

226 
227 
22« 

9 

2 3(1 

231 

232 

233 
23A 
235 
23  5 
237 
23H 
23  8 


3f  SUMMARY  OF  Th£  SYSTEM  PR03AB ILIT lES . 
VERSION  NC.  l.A 


HOURS  (FH>:  1=  1.0000*-00 

ONRELIAblLITY 


GATE 

RELIABILITY  TYPE  HOURLY  RATE  FH 


GATE 


UNRELIABILITY 

RELIABILITY 

TYPE 

GATE  INPUT 

1*736D-0A 

0.  99982  64150677376 

C 

49 

52 

77 

83 

1. 736D-04 

5.9998264150677376 

C 

50 

mi  4 

53 

78 

1.  73o'J-04 

0.9998264150677376 

c 

r ^ 

51 

54 

79 

.*<5 

9.  G383-.‘'3 

G.  999-#9  99i;961535-<7 

2 

2C0 

201 

202 

2.8270-^4 

0. 9997172599787033 

0 

49 

52 

86 

95 

F8 

2.  82  70-34 

C . 9997172599787033 

c 

50 

53 

87 

96 

59 

?.  82  70-04 

0 . 99*1  7172599787033 

c 

51 

54 

88 

97 

ICO 

2. 396D-: 7 

: . 9999997602196518 

4 

204 

205 

206 

2.5740-08 

U.  9999999742626313 

/ 

203 

207 

— 

1. 4390-04 

C.999856<;7035«9861 

c 

49 

52 

86 

1. 4390-24 

.999856':  703599 861 

c 

50 

53 

87 

1.  4o9u-'.'4 

C . 9998560  7035898bl 

f 

51 

54 

88 

6. 2140-08 

U,999999'’378588l36 

2 

209 

210 

211 

1.  0o2l<-04 

0. 99989378564122C.5 

c 

49 

52 

101 

1. Cb20-04 

: .9998937856412365 

c 

50 

53 

102 

1 » Cb20 -04 

, 9y4893785b4l23S5 

c 

51 

54 

103 

3.  38  4U-0ti 

0. 99V999>6bl57’ 7C  i 

2 

213 

214 

215 

1. 5340-04 

0 . 99984  46120  740  83^ 

C 

49 

52 

77 

1 • 5ri40-'j4 

99484 4bl2G  740  93^ 

C 

50 

53 

78 

1. £j40-04 

C. 99?844bl20740R39 

r 

51 

54 

79 

7.2430-:« 

•;  .994999  927571369  5 

2 

217 

218 

219 

1.  036J -04 

G • 979  89  C4  053bb364o 

C 

49 

52 

114 

1 . C 3U  j - 1)4 

J.  99489  64053663  946 

c 

50 

53 

115 

1. C3oJ-04 

. . 999  84  64  3 5366.3  a<»4 

c 

51 

54 

1 16 

3 • 2 1 5 - 3 8 

: . 999''98. *67806721  2 

2 

221 

222 

223 

2.S72D-}S 

: , 9'^  9999  <742789577 

t 

22C 

224 

-m— 

7.  C2  8L'-:.", 

:■ . 899498-2-77245910 

c 

208 

212 

216 

U 3J20-04 

V , 999‘*b6'i0n«  7J834  '’ 

r 

43 

49 

52 

l.3J2':-3  4 

U . 99  >366  8088  708  38  4 

C 

44 

50 

53 

1. 332. -}4 

. . 9998668088738389 

c 

45 

51 

54 

5. 3210-Cb 

C. 9999999467851602 

4 

22  7 

228 

229 

?.  C.4faj-’4 

' . 999  79142175563'*3 

c 

26 

35 

39 

1. 3560-: 4 

: , 994St.44  0919337-»2 

c 

27 

36 

40 

1 « 3ri60  — 34 

a.  99986440‘’19337^2 

. c 

28 

37 

41 

7.  4*7  4L  -0  h 

0. 9999999250603042 

4 

251 

232 

233 

U 727.-37 

• . 9999998272932571 

i C 

226 

230 

234 

1 > 554J-04 

3,9998446120740359 

i c 

49 

52 

77 

1 . 554U-04 

0 . 999  84  46120  740  359 

c 

50 

53 

76 

1. E34D-34 

; .9998446120  740839 

c 

51 

54 

79 

7, 243L-.S 

; . 999  99992757136(.3 

2 

236 

237 

238 

Airspeed 
from  DADC 


Pitch  angle 
from  IRS 


Both  above  sensors 


98 

39  ' Pi 
100  fn 

4 


Pitch  angular  rate 
from  IRS 


Column  force 


80  . 

Dynamic  pressure,  q, 
I from  DADC 


0' 

1 

2 

4 


Flap  position 
(backup  for  q) 


q with  backup 

225“^  All  sensors 

Computation 


Elevator  actuators 
- Full  PAS,  top  gate 


8 0 
81 
82 


Figure  B-8.  Fault  Tree  Computer  Printout 


B-11 


240 

1. 0 363 -04 

C . 999H'’64053663a»6 

C 

49 

52 

114 

241 

1 • 0 3d1  - O'* 

OrVVH-*  <164053663  84  6 

c 

50 

53 

115 

242 

l.«“56J-C4 

. . 999£i9  64-536b3«46 

c 

51 

54 

1 16 

34J 

3.  2190-iM 

. 99999  S'‘678  0 67  21? 

2 

240 

241 

242 

244 

2.5/2J-0R 

0 . 99999997427895/7 

239 

243 

2 43 

1»  C62'J  -04 

0.999a937S56412365 

c 

49 

52 

101 

244 

1.06 20-? 4 

•.9999937856412365 

c 

50 

53 

1C2 

247 

1. 0o2D-  :-4 

. . 9998937836412365 

c 

51 

54 

103 

248 

3. 3«4J-08 

(j  . 999  9996oo1579705 

2 

245 

246 

247 

243 

3.  1443-04 

0.9996855994344449 

c 

49 

52 

86 

89 

92 

95 

98 

253 

3.1443-04 

: . 9996355994344449 

c 

50 

53 

87 

90 

93 

96 

99 

251 

3* 1443-04 

0.9996855994344449 

c 

51 

54 

ee 

91 

94 

97 

ICO 

25  2 

2.965J-C  / 

1,  .99999970351  92431 

2 

249 

250 

251 

253 

1.  C36'j-:4 

■’  . 9599964"53663846 

c 

49 

52 

114 

254 

1. C36D-:4 

C . 9998964053663846 

0 

50 

53 

1 15 

255 

1. 0360-04 

0. 9998964053663846 

c 

51 

54 

116 

256 

3.2190-08 

0. 9999999678367212 

2 

253 

254 

2 55 

257 

3. 11 1:-’  7 

' . 99'<9996389307135 

c 

244 

248 

252 

256 

258 

1.3320-04 

C. 9998668088708389 

c 

43 

49 

52 

259 

1.3320-04 

0. 9998668083708399 

c 

44 

50 

53 

260 

1.332D-C4 

C . 999866803870838^- 

c 

45 

51 

54 

261 

5. 3210-:P 

0. 9999999467851 6C 2 

2 

258 

259 

260 

26  2 

2. 0240-04 

3. 99979  76204316349 

c 

29 

43 

46 

49 

52 

59 

263 

2. 0240-04 

i .9997976204816349 

c 

30 

44 

47 

50 

53 

58 

264 

4.  0960-08 

0.9999999590425666 

2 62 

263 

265 

3.618D-07 

0. 9996996382384330 

c 

257 

261 

264 

266 

1. 4390-04 

U. 969 856073 3589861 

c 

49 

52 

86 

98 

267 

1. 4390-04 

:. 9993560703589861 

c 

50 

53 

87 

99 

263 

1.4390-04 

0.99985607C35S98bl 

c 

51 

54 

38 

100 

269 

6.2140-08 

0.9999999378588136 

2 

266 

267 

268 

270 

!• 8160 -04 

0.9998184164383776 

C 

49 

52 

74 

80 

2 71 

1.8160-04 

0. 9998184164883776 

C 

50 

53 

75 

81 

272 

1.8160-04 

. 99981  84164883776 

C 

51 

54 

76 

82 

273 

9.8910-08 

0 . 99999  990109430t>3 

2 

2 70 

271 

272 

27  4 

1.5540-04 

0.99934  46120  740839 

C 

49 

52 

77 

80 

275 

1.5540-04 

j.  9998446120  740R39 

C 

50 

53 

78 

81 

276 

1.5540-04 

J. 9998446120740 839 

C 

51 

54 

79 

82 

277 

7.243D-C8 

0.9999999275713663 

2 

274 

275 

276 

278 

1. 0620-04 

0.99939 38056391013 

C 

49 

52 

117 

279 

1.0620-04 

0.9998933056391013 

C 

50 

53 

118 

280 

1.  C620-:-4 

0.9998938056391013 

C 

51 

54 

119 

2H1 

3.3h  33-08 

0.999  99  9966170^7024 

278 

279 

280 

282 

1. 0360 -G4 

: . 9998964053663846 

C 

49 

52 

114 

283 

1.C360-C4 

C .9998964053663846 

0 

50 

53 

115 

284 

1.  C360-04 

0 . 9998964053663846 

c 

. 51 

54 

116 

285 

3.219J-08 

0.9999999678067212 

2 

2 32 

283 

284 

266 

1.855D-C7 

0.99999  98145028  344 

C 

269 

273 

277 

281 

285 

287 

1.332D-04 

0*9998668088708389 

c 

43 

49 

52 

288 

1. 3320-04 

3. 9998668088708389 

c 

44 

50 

53 

289 

1.3320-04 

0 .9998bb808870834'» 

c 

45 

51 

54 

290 

5.3210-09 

0. 9999999467851602 

2 

2 87 

288 

289 

291 

1. 6630-C4 

0.9998337138272043 

c 

43 
110 

44 

46 

49 

52 

292 

1.51CD-M 

C .9998490114:00524 

c 

47 

50 

53 

293 

1.51C0-G4 

: . 9993490114':005.?4 

c 

45 

48 

51 

54 

Figure  B-8.  Fault  Tree  Computer  Printout  (Continued) 


LAS  top  gate 
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294 

2.2«CD-C8 

C . 9999999772024733 

t 

292 

293 

295 

1.532C-05 

0. 9999846/73198666 

C 

111 

294 

296 

2. 316C-04 

0. 9997684040250833 

C 

31 

291 

255 

29  7 

1.510D-04 

C .9998490114600524 

c 

43 

46 

49 

52 

29  8 

1.51CD-04 

3.9998490114000524 

c 

44 

47 

SO 

53 

299 

2«280u-08 

0. 9999999772024733 

« 

297 

298 

300 

1.532D-05 

0.9999846773198666 

c 

113 

299 

331 

1.6b3L-34 

O'. 9998337133272045 

c 

45 

48 

51 

54 

112 

302 

2.3163-04 

0. 9997684040250853 

c 

32 

300 

301 

303 

9. 9210-08 

0. 9999999007893862 

« 

296 

3C2 

304 

2. 59  CD -0  7 

0.9999997410523336 

c 

286 

290 

3C3- 

AAL  top  gate 

30  5 

1. 5540-04 

: .9998446120740839 

c 

49 

52 

77 

90 

30  6 

1.5540-04 

0.9998446120740839 

c 

50 

S3 

78 

91 

307 

1.5540-04 

0.95  78446120740B39 

c 

51 

54 

75 

32 

309 

7.  ?430-0« 

C.  99999  9927571.3663 

2 

3C5 

306 

337 

30  9 

.5.C130-U4 

: .99979a72325°5665 

c 

49 

52 

82 

65 

310 

2. C13J-04 

0. 99979872025‘55665 

c 

50 

53 

63 

68 

311 

2.  C130-04 

0. 9997987202595645 

c 

51 

54 

64 

87 

312 

1.2150-C7 

:.999a99%7847574l5 

2 

309 

310 

311 

313 

1. 3320-04 

: . 99#  H6fc>i08.87;  8388 

C 

43 

49 

52 

314 

1.3320-04 

U. 9998668088708389 

C 

44 

50 

53 

315 

1. 3325-04 

3. 999866803870338? 

c 

45 

51 

54 

316 

5.3210— 58 

: .9999999467H516'12 

2 

313 

314 

315 

317 

1.6700-04 

0 . 99983301-39438620 

C 

10 

43 

48 

49 

52 

58 

315 

1. 67C.J-04 

■;  . 999  83  3:  13  94  386  ’ 0 

c 
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Figure  B-8.  Fault  Tree  Computer  Printout  (Continued) 
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Figure  B-8.  Fault  Tree  Computer  Printout  (Concluded) 


B-15 


Another  FTREE  advantage  is  that  a minor  change  in  the  makeup  of  the  last  gate  of  the 
file  will  permit  investigation  of  other  combinations  of  events.' 

The  last  page  of  Figure  B-8  shows  sensitivity  of  the  top  gate  to  multiple-occurring  events. 
The  number  given  is  the  change  in  unreliability  that  would  occur  at  the  top  gate  if  the 
component  under  consideration  were  made  perfectly  reliable.  Events  (components)  are 
ranked  in  decreasing  order  of  influence. 

B.2.3  MINTERM  PROVISION 

FTREE  provides  outputs  of  all  minterms  that  represent  failures  of  the  function  (top  gate). 
This  information  is  helpful  when  determining  what  input  signals  are  needed  to  provide 
fault  advisories  to  the  flight  crew.  Unfortunately,  the  entire  set  of  failure-producing 
minterms  are  calculated  and  printed.  For  example,  if  loss  of  computer  A and  actuator  B 
could  disable  LAS,  then  all  minterms  that  include  computer  A and  actuator  B will  be 
provided. 

The  fault  tree  analysis  program  (FTAP)  is  a new  program  initiated  at  Stanford  University. 
FTAP  provides  the  same  information  in  a more  convenient  form,  which  is  cut  sets.  Cut 
sets  are  all  those  combinations  of  components  that  can  produce  a failure  probability  as 
great  as  a preset  threshold.  In  the  preceding  example,  the  A computer  failure  and  B 
actuator  failure  will  make  up  an  entry  if  the  probability  of  their  joint  occurrence  is  as 
great  as  a value  the  operator  has  preset.  Figure  B-9  is  a portion  of  a printout  of  such  an 
FTAP  computer  run.  FTAP  also  can  combine  many  more  problems  into  one  computer  run, 
thereby  saving  cost. 

For  future  studies,  we  are  coordinating  with  the  Raytheon  Corporation  to  incorporate  the 
FTREE  program  as  the  input  end  to  the  computer-aided  reliability  estimates  (CARE  III) 
program.  This  should  expand  the  reliability  calculation  capability  to  include  latent 
failures,  leakage,  coverage,  intermittence,  and  recovery  from  transient  failures. 

B.2A  PREDICTION  OF  SELECTED  SYSTEM  FLIGHT  SCHEDULE  RELIABILITY 

Construction  of  the  fault  trees  defines  the  logic  that  the  FTREE  program  uses  in 
prediction.  A brief  examination  of  the  fault  trees  will  help  to  explain  how  the  Selected 
System  flight  schedule  reliability  predictions  of  Volume  I,  Subsection  9.2.2,  were  made. 
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Figure  B-9.  Fault  Tree  Analysis  Program  and  Cut  Sets 
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Figure  B-10  is  the  crucial  PAS  fault  tree.  The  OR  gate  at  the  top  of  the  tree  feeds  the 
undesirable  event  "Essential  PAS  Inoperative."  If  any  of  the  three  inputs  to  this  gate  is 
positive  (indicating  a fault),  the  output  indicates  a fault;  namely,  that  Essential  PAS  is 
inoperative.  The  sensor  fault  gate  is  an  M of  N gate  described  in  Figure  B-10,  meaning 
that  if  any  three  of  the  four  inputs  (or  all  four)  are  positive,  the  output  is  positive.  The 
FTREE  program  tries  all  the  possible  combinations.  Each  input  to  this  gate  is  simply  the 
event  that  one  dedicated  Q sensor  is  inoperative.  The  computer  fault  gate  is  similar, 
except  that  the  four  inputs  to  the  M of  N are  now  the  outputs  of  OR  gates.  The  event 
that  a computer  is  inoperable  is  combined  with  the  possible  event  that  the  computer 
program  is  faulty,  because  either  of  these  could  suffice  to  make  the  computer  function 
faulty.  The  actuator  fault  gate  is  similar  in  that  the  actuator  is  combined  in  an  OR  gate 
with  the  supporting  hydraulic  system  and  with  the  appropriate  computer.  The  actuator 
depends  upon  the  hydraulic  system  for  power  and  upon  its  own  channel's  computer  to 
provide  it  with  control  signals;  i.e.,  the  actuator  is  dependent  on  its  own  computer.  Any 
one  of  the  three  could,  by  failing,  make  that  channel's  actuation  inoperative.  The 
Essential  PAS  fault  tree  is  unique  among  the  set  in  that  the  sensors  do  not  show  such  a 
dependency  upon  their  associated  computers  to  accept  their  signals;  i.e.,  in  this  instance 
only,  the  sensors  are  each  cross  strapped  into  all  computers. 

The  Full  PAS  fault  tree  (fig.  B-11)  is  very  similar  in  structure.  The  sensors  are  dependent 
upon  the  computers  to  accept  their  signals.  The  partitioning  of  computer  failure  rates 
(vol.  I,  subsec  9. 2. 1.1)  permits  including  only  those  parts  of  the  computer  that  are  required 
to  be  operable  to  receive  the  sensor  inputs.  Under  q sensing  fault,  the  DADC  also  has 
been  partitioned  into  the  q parts  and  those  common  parts  (power  supplies,  cooling, 
structure)  that  are  required  to  provide  a q (dynamic  pressure)  output.  A failure  is  not 
charged  for  other  parts.  The  additional  function,  gain  scheduling,  is  backed  up  by  an 
alternate,  flap  position,  so  that  both  must  have  produced  a fault  input  to  the  gain 
scheduling  fault  AND  gate  to  get  a fault  output.  These  backup  functions  appear  in  several 
ACT  functions  and  result  in  the  backed-up  function  being  virtually  infallible.  The  phugoid 
stabilizer  sensing  fault  is  another  such  backed-up  function.  The  computers  are 
conspicuous  by  being  included  in  every  sensor  and  actuator  branch  of  the  tree.  The 
dependency  of  sensors  and  actuators  for  communication  to  the  rest  of  the  system  makes 
the  computers  and  their  reliability  extraordinarily  important.  In  this  tree,  the  computers, 
subfunctions  of  the  DADC,  and  the  IRS  are  all  multiple-occurring  events. 
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The  LAS  and  angle-of-attack  limiter  (AAL)  (stick  pusher  and  stick  shaker)  fault  trees 
(figs.  B-12  through  B-1^)  follow  the  same  pattern.  The  stick  pusher  actuation  is 
complicated  by  the  need  to  ensure  against  inadvertent  actuation.  Each  actuator  is 
precluded  from  operating  unless  both  solenoid  valves  open,  so  both  valves  and  two  power 
sources  are  combined  in  an  OR  gate;  thus  failure  of  any  one  could  produce  actuator 
failure,  but  both  actuators  would  have  to  fail  to  produce  AAL  actuation  failure. 

Figure  B-15  predicts  the  probability  of  inadvertent  stick  pusher  actuation.  In  this  case, 
failure  in  the  sensors  is  not  passive  but  produces  a false  signal  that  calls  for  actuation 
when  it  is  not  required.  Failure  In  the  actuation  consists  of  actuation  in  the  absence  of  a 
computer  input  signal  calling  for  actuation.  The  computer  fault  consists  of  the  computer 
producing  an  output,  in  the  absence  of  the  appropriate  sensor  inputs,  that  the  program  and 
the  rest  of  the  computer  fail  to  detect  and  deactivate.  Commercial  aircraft  experience 
provided  almost  no  data  from  which  to  calculate  rates  for  such  failure  modes,  so 
conservative  estimates  were  made.  This  fault  tree,  having  an  entirely  different  set  of 
failure  mode  input  events,  cannot  be  combined  with  the  rest  of  the  ACT  function  fault 
trees  to  find  the  probability  of  joint  failures. 

The  wing-load  alleviation  (WLA)  fault  tree  (fig.  B-16)  is  the  most  complex  because  of  the 
large  number  of  surfaces  controlled,  but  the  same  principles  apply.  . The  multiple 
actuators  are  each  dependent  upon  one  of  these  hydraulic  systems,  which  makes  the 
hydraulic  systems  multiple-occurring  events.  The  FMC  fault  tree  is  shown  in  Figure  B-17. 

The  fault  trees  described  detail  the  failure  modes  that  can  lead  to  an  ACT  function 
becoming  inoperative.  In  some  instances  it  is  necessary  to  know  the  probability  of 
encountering  the  condition  in  which  one  more  component  failure  would  cause  a function 
failure,  because  this  may  call  for  flight  envelope  restriction.  Such  a probability  can  be 
calculated  with  a similar  fault  tree  that  simply  redefines  what  constitutes  failure.  The 
adaptation  of  the  Full  PAS  fault  tree  for  one  failure  away  (fig.  B-18)  is  an  example.  The 
only  change  necessary  was  to  replace  the  gates  that  required  two  of  three  redundant 
inputs  to  fail  with  gates  that  require  one  of  three  (i.e.,,one  less  than  what  would  cause  the 
function  to  become  inoperable).  A one  of  three  gate  is  simply  an  OR  gate. 

The  probability  of  being  required  to  divert  during  a 1-hr  flight  is  the  probability  of  being 
one  failure  away  from  the  loss  of  Essential  PAS  or  one  failure  away  from  loss  of  all  of  the 
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Figure  B-1 2.  Lateral/Directional-Augmented  Stability  Fault  Tree 
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set  (Full  PAS  and  LAS  and  WLA).  Figure  B-5  shows  the  fault  tree  for  this  condition.  Four 
gates  feed  into  the  top  OR  gate.  Any  of  them  can  produce  a condition  where  the  pilot 
should  divert.  The  first,  being  one  failure  away  from  loss  of  Essential  PAS,  is  simple 
enough.  We  need  three  other  inputs,  each  representing  two  functions  failed  and  one 
function  one  failure  from  becoming  inoperable  for  the  set  of  Full  PAS  and  LAS  and  WLA. 


Figure  B-13.  Angle-of-Attack  Limiter  {Stick  Pusher)  Fault  Tree 
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Figure  B-14.  Angle-of-Attack  Limiter  (Stick  Shaker)  Fault  Tree 
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Figure  B-15.  Stick  Pusher  Inadvertent  Action  Fault  Tree 
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Figure  B-16.  Wing-Load  Alleviation  Fault  Tree 
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Figure  B-16.  Wing-Load  Alleviation  Fault  Tree  (Continued) 
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Figure  B- 18.  Adaptation  of  Full  Pitch-Augmented  Stability  Fault  Tree  for  One  Failure  Away 
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APPENDIX  C:  PITCH  AXIS  FLY-BY-WIRE  ACTUATOR 


Volume  I,  Subsection  6.5,  describes  a pitch  axis  fly-by-wire  (FBW)  control  actuator  and 
compares  it  with  a conventional  actuator  system  in  terms  of  weight,  cost,  and  reliability. 

The  pitch  axis  FBW  actuator  installation  drawing  (fig.  C-1),  in  conjunction  with  Figure  16 
(vol.  I),  provides  schematics  of  the  elevator  FBW  control  system. 

C,1.0  DESCRIPTION  OF  THE  SERVO  ACTUATOR  DESIGN 

The  actuator  is  sized  to  provide  the  elevator  full  force  and  rate  capability.  The  pitch  axis 
FBW  servoactuator  is  shown  in  Figure  C-2.  The  actuator  is  driven  by  a jet  pipe 
servovalve.  A linear  variable  differential  transformer  (LVDT)  is  attached  to  the  spool  of 
the  servovalve  for  redundancy  management.  A differential  pressure  transducer  is 
installed  between  each  servovalve  and  actuator  to  equalize  the  output  forces  of  the  three 
servoactuators.  A bypass  valve  is  employed  to  control  the  operational  mode  of  the 
servoactuator.  If  a control  loop  failure  occurs,  the  normally  closed  dual-coil  solenoid 
valve  will  allow  the  bypass  spring  to  drive  the  bypass  valve  to  a position  that  disconnects 
the  servoactuator  from  the  hydraulic  supply  and  reduces  its  output  force  to  a minimum. 
As  long  as  the  control  loop  is  free  of  failure,  the  solenoid  valve  will  position  the  bypass 
valve  to  allow  the  servoactuator  to  operate  normally. 

C.2.0  NONLINEAR  DYNAMIC  SIMULATION 

A nonlinear  dynamic  mathematical  model  computer  program  was  written  for  the 
servoactuator  and  its  failure  detection  scheme  to  ensure  that  the  servoactuator  system 
would  respond  as  required. 

A computer  run  was  made  using  this  mathematical  model.  A 50%  step  input  command 
was  applied.  Results  of  this  computer  run  show  that  the  servoactuator  response  is 
overdamped  and  the  control  loop  is  stable. 
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Figure  C-2.  Servoactuator  Drawing 


C.3.0  REDUNDANCY  CONCEPT 


C.3.1  SERVOVALVE  MONITOR  CONCEPT 

The  redundancy  concept  used  for  the  pitch  axis  FEW  servoactuator  is  shown  schematically 
in  Figure  C-3.  This  figure  shows  that  the  response  of  the  servodriver  amplifier  and 
servovalve  is  compared  to  the  response  of  a model  of  the  servodriver  amplifier  and 
servovalve  driven  by  an  identical  command  signal.  The  LVDT  is  the  only  component  in  the 
control  loop  whose  performance  is  not  monitored  by  this  redundancy  method.  Hence  a 
center  tap  (self-monitoring)  LVDT  is  used.  When  the  difference  between  the  displacement 
of  the  second-stage  spool  and  its  electronic  model  exceeds  a preset  threshold  level,  a 
failure  detect  signal  is  attained.  Also,  a first-order  filter  with  a time  constant  is 
incorporated  to  reduce  the  dynamic  mismatch  between  the  electronic  servovalve  model 
and  the  actual  servovalve  during  transient  conditions. 

To  investigate  the  effects  of  a control  loop  component  failure,  the  nonlinear  dynamic 
mathematical  model  computer  program  discussed  previously  was  used  to  conduct  a failure 
transient  analysis.  The  failure  analysis  run  was  made  by  applying  a zero  command  to  the 
servoactuator  control  loop  and  inducing  a hardover  servovalve  failure.  Results  of  the 
computer  run  show  that  following  a failure,  the  actuator  will  travel  less  than  10%  of  full 
stroke  before  it  is  placed  in  the  failed  mode.  Worst  case  static  and  dynamic  mismatches 
between  the  servovalve  and  the  electronic  model  were  used. 

C.3.2  SERVOACTUATOR  EQUALIZATION 

One  problem  associated  with  connecting  multiple  actuators  to  a common  load  is  getting 
them  to  share  the  load  equally  instead  of  engaging  in  force  fight  due  to  tolerances  in  the 
control  loop.  To  minimize  force  fight,  a scheme  of  one  active  and  two  online  channels  is 
used  as  shown  in  Figure  C-4.  In  this  scheme,  one  active  channel  or  actuator  is  position 
responsive  and  establishes  elevator  position.  The  two  online  actuators  are  also  position 
responsive  and  are  force  output  limited.  This  force  limiting  is  accomplished  by  using 
differential  pressure  feedback  from  the  two  online  actuators. 

If  the  elevator  is  subjected  to  oscillatory  loads,  it  is  desirable  to  have  the  two  online 
servoactuators  share  these  loads  with  the  active  actuator.  The  online  actuators  are  soft 
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at  low  frequencies  but  can  respond  to  their  share  of  the  oscillatory  loads  at  high 
frequencies. 

If  one  of  the  active  actuator  channels  fails,  then  one  of  the  online  actuators  becomes 
active  by  automatically  turning  off  the  AP  feedback  to  that  actuator.  If  the  second 
active  actuator  channel  fails,  then  the  remaining  online  actuator  becomes  active. 

Various  channel  mismatch  conditions  were  investigated  in  the  pitch  axis  FBW  system.  The 
types  of  mismatching  considered  were  (1)  servovalve  null  bias  mismatches  and  (2) 
servovalve  pressure  gain  mismatching.  The  latter  was  obtained  by  mismatching  the 
amount  of  overlap  or  under  lap  length  on  each  servovalve. 

Computer 
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KFB  LVDT  feedback  gain 
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Figure  C-3.  Failure  Detection  Schematic  for  Pitch  Axis  Fly  by  Wire 
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Figure  C-4.  Pitch  Axis  Fly-by-Wire  Equalization 


Frequency  response  was  investigated  to  determine  whether  mismatching  could  cause  force 
fighting  between  channels  that  might  attenuate  the  dynamic  response.  The  frequency 
response  was  not  significantly  different  under  any  of  the  conditions  investigated. 

Step  commands  for  various  mismatch  conditions  were  input  into  the  system  in  an  attempt 
to  trigger  nuisance  failures.  At  no  time  did  the  detection  parameters  come  close  to  the 
threshold  level. 


CA.O  PITCH  AXIS  FBW  ACTUATOR  INSTALLATION 

The  pitch  axis  FBW  actuator  installation  is  shown  in  Figure  C-1.  The  pitch  axis  FBW 
actuator  is  within  its  prescribed  enveiope. 

C.5.0  RELIABILITY  ANALYSIS 

Analysis  of  the  pitch  axis  FBW  servoactuator  yields  an  estimated  mean  time  between 
failures  of  25  253  hr,  as  shown  in  Figure  C-5.  Table  30  of  Reference  C-1  lists  the  failure 
rates  used. 


• Mean  time  between  failures:  25  253  hr 
’Failure  rates  (X)  based  on  Table  30  of  Reference  C-1 


Figure  C-5.  Pitch  Axis  Fly-by-Wire  System  Reliability  Model 
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APPENDIX  D:  FLAPERON  ACTUATION  SYSTEM  DESIGN  TRADE  STUDY 


The  purpose  of  the  flaperon  study  was  to  develop  three  viable  actuation  design  concepts 
to  operate  a wing  trailing-edge  flaperon  and  assess  the  relative  merits  of  each  concept. 
These  actuation  concepts  were  studied: 

• Hydromechanical  actuation  system 

• Electromechanical  actuation  system 

• Integrated  actuator  package 

The  only  constraint  imposed  during  the  study  was  that  the  actuation  systems  be  designed 
with  state-of-the-art  hardware  technology  that  has  proved  its  maturity  in  commercial  and 
military  applications.  This  constraint  ensured  that  assessment  of  system  performance 
and  reliability  would  be  based  on  available  technical  data. 

The  following  design  ground  rules  were  assumed  for  all  three  concepts: 

• The  flaperon  actuation  system  is  flight  critical. 

• A minimum  of  two  systems  is  required  for  redundancy  management. 

• Failure  transients  shall  be  held  to  a minimum,  and  hardover  failures  are  not  allowed. 

• Because  it  is  not  practical  to  provide  mass  balance  in  the  flaperon  structure  for 
surface  flutter  suppression,  means  must  be  provided  to  prevent  surface  flutter  in  the 
event  of  total  power  loss  to  the  flaperon  actuation  system.  Flaperon  surface  locking 
is  the  means  provided. 

• Preflight  test  must  be  performed. 

D.1.0  HYDROMECHANICAL  ACTUATION  SYSTEM 

The  hydromechanical  actuation  system,  based  on  performance,  weight,  cost,  reliability, 
and  state  of  the  art,  was  selected  as  the  ACT  system  technology  base  flaperon  actuation 
system.  This  system  is  discussed  in  Volume  I,  Subsection  8. 1.3. 3,  Flaperon  Actuation 
System. 
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D.2.0  ELECTROMECHANICAL  ACTUATION  SYSTEM 


An  industry  survey  was  conducted  to  determine  usage  of  electromechanical  actuation 
systems  on  commercial  and  military  aircraft.  The  results  of  the  survey  showed  that  no 
electromechanical  actuation  systems  were  employed  on  primary  control  surfaces.  It  was 
found  that  the  most  advanced  electromechanical  actuation  system  is  the  prototype  unit 
built  by  Delco  for  NASA.  A design  constraint  was  imposed  that  only  state-of-the-art 
hardware  be  used.  Hence,  this  constraint  eliminated  the  electromechanical  actuation 
system  as  a viable  flaperon  actuation  system  option. 

D.3.0  INTEGRATED  ACTUATOR  PACKAGE 

The  integrated  actuator  package  (lAP)  is  a system  that  takes  aircraft  electric  power  in 
lieu  of  hydraulic  power.  The  lAP  will  apply  the  specified  hinge  moment  and  rate  to  the 
surface  by  hydraulic  power  that  is  generated  within  the  lAP.  The  package  contains  the 
motor-pump  reservoir  and  valving  necessary  to  generate  and  control  the  hydraulic  power, 
the  servoactuator,  and  the  heat-dispensing  mechanism. 

D.3.1  lAP  SYSTEM  DESCRIPTION 

Three  lAP  concepts  were  investigated  during  this  study:  (1)  servopump,  (2)  pump-motor- 
reservoir  with  an  accumulator,  and  (3)  pump-motor-reservoir  without  an  accumulator. 
These  three  concepts  were  examined  to  determine  their  suitability  for  the  flaperon 
requirements.  This  investigation  is  summarized  in  the  following  paragraphs. 

Servopump— The  Air  Force  has  done  considerable  development  work  on  servopumps.  An 
example  is  the  Sperry  Vickers  servopump  on  the  Air-Force-funded  6803  using  the  F-U 
aircraft  (ref  D-1).  This  research  program  was  concluded  in  1973.  Neither  this  program 
nor  any  Air  Force  projects  has  resulted  in  a production  servopump.  Because  one  of  the 
ground  rules  for  this  study  was  state  of  the  art,  it  was  concluded  that  none  of  the  Air 
Force  servopumps  qualifies. 
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The  British  Aircraft  Corporation  commercial  aircraft  VC-10  does  use  servopumps 
manufactured  by  Boulton-Paul.  The  characteristics  of  this  servopump  are  as  follows: 

• Rate  25.2  deg/s 

• Hinge  moment  468  887  N*m  (91  500  in-lbf) 

• Weight  37.14  kg  (81.9  lb) 

The  rate  was  not  sufficient  (80  deg/s  required),  and  Boulton-Paul  was  not  interested  in  a 
redesign. 

Pump-Motor-Reservoir  With  an  Accumulator— The  pump-motor-reservoir  with  an  accumu- 
lator adds  stored  energy  to  the  system  by  an  accumulator,  allowing  a possible  reduction  in 
the  size  of  the  pump-motor.  Use  of  an  accumulator  requires  detailed  knowledge  of  the 
duty  cycle,  and  this  duty  cycle  was  not  available  until  late  in  the  study.  The  objective  of 
this  phase  of  the  study  was  a trade  between  the  lAP  concept  and  the  other  concepts  as 
noted  in  Volume  I,  Subsection  8. 1.3.3.  The  addition  of  an  accumulator  would  not  influence 
the  conclusion  of  this  trade;  therefore,  study  on  this  concept  was  terminated. 

Pump-Motor-Reservoir  Without  an  Accumulator— The  pump-motor-reservoir  without  an 
accumulator  is  the  concept  included  in  this  study. 

The  system  schematic  is  shown  in  Figure  D-1.  The  electric  power  is  supplied  to  the 
motor,  which  drives  a variable-displacement  pump.  The  flow  from  the  pump  is  routed  to 
the  servovalve  through  a filter.  The  pump  outlet  pressure  is  also  routed  to  the  bootstrap 
reservoir  to  maintain  the  690-kPa  (100-lbf/in  ) return  pressure.  The  return  flow  comes 
from  the  electrohydraulic  valve  through  the  return  filter  and  flows  through  the  electric 
motor  for  cooling.  From  the  motor  the  flow  connects  with  the  case  drain  flow  and  goes  to 
the  reservoir  and/or  to  the  pump  inlet.  The  system  also  contains  a bypass  valve  around 
the  supply  pressure  filter  and  various  differential  pressure,  pressure,  and  thermal 
switches.  The  thermal  switch  signals  the  blower  motor  to  turn  on  or  off  and  informs  the 
aircraft  computer  of  an  overtemperature  condition.  The  pressure  switches  inform  the 
aircraft  computer  of  a failure.  The  differential  pressure  switch  and  fluid-level  indicator 
switch  are  used  during  routine  maintenance  to  indicate  a dirty  filter  and  fluid  level. 
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Abbreviations: 

EHV  electrohydraulic  valve 

LVDT  linear  variable  differential  transformer 


Figure  D- 1.  Flaperon  Integrated  Actuator  Package  Schematic 
(Large  Droop  Cutoff  Pump) 


D.3.2  REDUNDANCY  CONCEPTS 


The  redundancy  concept  for  the  servoactuator  in  the  lAP  is  exactly  the  same  as  the 
concept  for  the  hydromechanical  actuator  system.  Two  force-sharing  actuators  and  two 
models  are  used,  as  shown  in  Volume  I,  Figure  52. 

The  hydraulic  power  unit  (HPU)  is  completely  redundant.  Each  servoactuator  has  its  own 
HPU.  The  HPU  has  several  monitor  points  for  failure  detection:  the  thermal  indicator 
and  the  pressure  switch.  These  two  signals  are  monitored  by  the  computer,  and  if  the 
temperature  or  pressure  is  excessive,  the  lAP  will  be  shut  down.  The  AP  across  the  filter 
and  the  reservoir  level  are  monitored  and  used  as  a ground  maintenance  reference. 

D.3.3  DESCRIPTION  OF  HARDWARE 

Figure  D-2  shows  the  general  arrangement  of  the  components.  The  pump  reservoir 
package  is  supplied  by  Abex  Corporation. 
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The  motor  is  a wet  design  with  Skydroi  fluid  flowing  through  for  cooling.  This  is  a 
440-Hz,  112V,  three-phase  motor. 

The  heat  exchange  is  a two-pass,  cross-flow,  oil-to-air  heat  exchanger.  The  air  for  the 
heat  exchange  is  provided  by  a blower  driven  by  a 440-Hz,  112V,  three-phase  motor. 

D.3.4  WEIGHT  ANALYSIS 

The  necessary  brackets  and  mounts  and  local  structural  enhancements  will  await  detailed 
design  of  the  flap-flaperon  and  supporting  structure.  Most  of  this  weight  omission  (i.e., 
the  weight  of  parts  required  to  react  the  actuator  loads)  is  the  same  for  both  the  lAP  and 
hydromechanical  systems.  The  extra  weight  for  this  lAP  (i.e.,  mounting  brackets  for  the 
various  lAP  components)  would  be  less  than  2.3  kg  (5  lb).  Weights  are  as  follows: 


Servoactuator 

4.34 

kg 

( 9.56 

lb) 

Lock 

2.70 

kg 

( 5.95 

lb) 

HPU 

10.48 

kg 

(23.10 

lb) 

Blower 

1.31 

kg 

( 2.88 

lb) 

Heat  exchanger 

2.27 

kg 

( 5.00 

lb) 

Fluid 

1.30 

kg 

( 2.86 

lb) 

Motor 

4.76 

J<S 

o 

• 

o 

M 

Total 

27.16 

kg 

(59.85 

lb)  + brackets 

D.3.5  RELIABILITY  ANALYSIS 

The  reliability  block  diagram  for  the  lAP  is  shown  in  Figure  D-3.  The  predicted  mean 
time  between  failures  (MTBF)  is  15  186  hr,  which  appears  reasonable  because  VC-10  lAPs 
have  demonstrated  an  MTBF  of  over  16  000  flight  hours. 
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‘Failure  rate,  X 

• Mean  time  between  failures  is  1 5 1 86  hr 


Figure  D-3.  Integrated  Actuator  Package  Reliability  Mode!  (Worst  Case) 


D.4.0  TRADE  STUDY  ASSESSMENT 

Following  completion  of  the  designs  of  the  hydromechanical  actuation  and  lAP  systems,  a 
trade  study  was  conducted  to  determine  the  optimum  actuation  system  for  the  flaperon. 
Assessment  of  each  system  was  based  on  performance,  weight,  and  reliability. 

Because  the  same  servoactuator  was  used  on  both  systems,  it  can  be  concluded  that  the 
performance  of  the  two  servoactuators  is  identical.  Table  D-1  shows  the  weight  and 
reliability  comparison.  It  can  be  concluded  from  Table  D-1  that  the  hydromechanical 
system  is  the  optimum  actuation  system  for  the  flaperon. 
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Table  D- 1.  Trade  Study  Assessment 


Hydromechanical  system 

lAP  system 

Weight 

Actuator 

Lock 

4.34  kg  (9.56  lb) 
2.70  kg  (5.95  lb) 

Actuator 

Lock 

HPU 

Motor 

Blower 

Heat 

exchanger 

Fluid 

4.34  kg  (9.56  1b) 
27Gkg  (5.951b) 
10.48  kg  (23.10  lb) 
4.76  kg  (10.50  lb) 
1.31  kg  (2.88  lb) 

2.27  kg  (5.001b) 
1.30  kg  (2.86  1b) 

7.04  kg  (15.51  lb) 

27.16  kg  (59.85  lb) 

Reliability 

Mean  time 

between 

failures 

33  168hr 

Mean  time 

between 

failures 

15  186  hr 
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APPENDIX  E:  TECHNICAL  APPROACH  FOR  ADVANCED  TECHNOLOGY 
CONTROL  LAW  SYNTHESIS  AND  ANALYSIS 


This  appendix  describes  in  some  detail  the  technical  approach  used  for  advanced 
technology  control  law  synthesis  and  analysis.  The  objective  has  been  to  develop  synthesis 
and  analysis  methods  suitable  for  the  design  of  gust-load  alleviation  (GLA),  flutter-mode 
control  (FMC),  and  rigid-body  stability  command  and  augmentation  control  laws  and  to 
demonstrate  the  potential  benefits  of  thereby  evaluating  the  closed-loop  performance  at 
specific  flight  conditions. 

The  complexity  of  the  control  task  and  the  dynamic  characteristics  of  a typical  flexible 
transport  airplane  dictate  the  solution  of  a coupled  multiloop  control  problem.  The 
classical  approach  of  synthesizing  one  loop  at  a time  is  not  well  suited  to  deal  efficiently 
with  coupled  multiloop  systems.  Modern  control  theory  offers  the  capability  of 
synthesizing  multiloop  systems  directly,  thus  taking  advantage  of  favorable  interactions 
between  the  control  loops. 

Figure  E-1  indicates  the  design  process  flow.  The  main  elements  are  model  generation, 
linear  analysis,  optimal  controller  design,  and  simulation.  The  design  is  accomplished 
using  a set  of  experimental  computer  programs  on  the  Control  Data  Corporation  (CDC) 
6600  system.  These  programs,  which  were  developed  by  Boeing  prior  to  this  contract,  are 
particularly  suited  for  the  analysis  and  synthesis  of  multivariable  controllers  for  Active 
Controls  Technology  (ACT)  airplanes.  They  are  based  on  time-domain  modern  control 
theory;  key  elements  are  state-space  representation  of  dynamic  systems,  modal  analysis, 
and  optimal  control  and  observer  (Kalman  filter)  designs.  In  addition,  portions  of  the 
environmental  control  analysis  system  (EASY  5)  and  QR  programs  are  used  (refs  E-1 
and  E-2). 


E.1.0  DYNAMIC  MODELS 

Control  law  synthesis  and  analysis  require  models  of  the  flexible  airplane,  the  measure- 
ments and  loads,  the  actuation  system,  and  the  wind  disturbances.  These  models  are 
connected  to  perform  open-loop  analysis,  control  law  synthesis,  and,  when  combined  with 
a control  law,  closed-loop  performance  evaluation. 
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Figure  E- 1.  Program  Structure 


E.1.1  FLEXIBLE  AIRPLANE  MODELS 

Two  configurations  were  analyzed  during  this  study.  The  first  was  based  on  the  drone  for 
aerodynamic  and  structural  testing  (DAST  2)  model.  The  second  was  based  on  the  Initial 
ACT  model.  The  unsteady  aerodynamic  representation  differed  in  these  two  analyses, 
although  in  both  cases  the  equations  of  motion  for  the  flexible  airplane  were  represented 
in  the  Laplace  domain. 


Figure  E-2  shows  the  two  forms  of  the  flexible  airplane  equations  of  motion  that  were 
used.  In  both  cases,  the  airplane  at  each  flight  condition  is  represented  by  a set  of 
constant  coefficient  linear  second-order  differential  equations  modified  by  the  addition  of 
first-order  lag  terms  that  represent  the  effects  of  unsteady  aerodynamics.  Figures  E-3 
and  E-4  are  block  diagram  descriptions  of  the  DAST  2 and  Initial  ACT  Airplanes, 
respectively.  There  are  blocks  representing  the  steady  and  unsteady  aerodynamic  forces, 
the  structural  model,  and  the  measurement  model.  These  block  diagrams  are  graphical 
descriptions  of  how  the  models  are  assembled  using  the  EASY  5 model  generation  routine. 
After  the  input-to-output  relations  of  each  block  and  the  block  interconnections  are 
specified  by  the  user,  a precompiler  program  generates  Fortran  subroutines  that  are 
combined  to  represent  the  complete  model  in  program  form.  The  individual  blocks  may 
represent  nonlinear  relationships.  These  models  are  used  to  perform  static  trim 
calculations,  conduct  simulations,  and  generate  linear  state  models  at  specified  operating 
points.  These  particular  formulations  produce  well-structured  state  vectors  consisting  of 
q,  rigid  and  elastic  model  coordinates;  q,  the  corresponding  rates;  w , unsteady  aero- 
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dynamic  states  due  to  wind;  and,  in  the  case  of  the  DAST  2 model,  q and  6,  unsteady 

aerodynamic  states  associated  with  q and  the  control  surface  vector,  5,  respectively. 

With  this  choice  of  states,  it  is  seen  that  the  unsteady  aerodynamic  forces  are  well 

defined  and  second  and  higher  order  derivatives  of  the  vectors  q,  5 , and  gust  velocity 

vector  w do  not  occur  as  states, 
g 


DAST  2 

^[mass]  +[ damping]  s +( stiffness] ^ |q(s)| 

f v[c,]»  *pv2[cj.,v2i,  [d, ])(,(,)) 

.(pv[c,]s.pv2[c„]  + pv2|,  ^ [dJ)[6(„] 

p.]) 


Initial  ACT  Airplane 


([S2]  + [S^]  s + [Sp]^|q(s)j  + ([§2]  s^  + [S^]  s + [Sq])  |6(s) 


where 


[Sq] 

[S^] 

[S2] 

[iol 

[S,] 

[S2I 


= [stiffness]  + 
= [damping]  + 
= [mass]  + 


[Aq] 

[A,] 


[Aq] 

[A,] 


= [control  surface  inertia] +-^  [A2] 


Aq,  Ag  are  quasi-steady  airforces  matrices 
Ai , A^ , A2,  A2  are  unsteady  airforces  matrices 
q Rigid-and  flexible-body  deflections 

6 Control  surface  deflections 

Wg  Gust  velocities 


Figure  E-2.  Equations  of  Motion 
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States: 


q Rigid-  and  flexible-mode  deflections 

q Corresponding  rates 

Unsteady  aerodynamic  states  associated  with  q 
Steady  aerodynamic  states  associated  with  6 
Unsteady  gust  states 


Figure  E-3.  Model  of  Drone  for  Aerodynamic 
and  Structural  Testing  2 Airplane 


States: 


q Rigid-  and  tlexible-mode  deflections 

q Corresponding  rates 

Wg  Unsteady  gust  states 


Figure  E-4.  Model  of  Initial  ACT  Airplane 


E-4 


• Second-order  and  higher  order  derivatives  of 
the  vector  q will  not  occur  as  states. 


Figure  E-5.  Modeling  of  Unsteady  Aerodynamics— Drone  for 
Aerodynamic  and  Structural  Testing  2 


Some  detailed  comments  are  pertinent  with  respect  to  modeling  unsteady  aerodynamic 
forces.  For  the  DAST  2 model,  the  unsteady  aerodynamic  forces  are  represented  by  the 
summation  of  the  outputs  from  four  first-order  lags  as  shown  in  Figure  E-5.  This  is  the 
result  of  an  approximate  transformation  from  a frequency-  to  time-domain  representation 
of  these  forces.  The  output  from  each  integrator  is  a state.  For  each  element  of  the 
input  vector,  q,  there  are  four  unsteady  aerodynamic  states.  The  same  holds  for  the 
control  surface  vector,  6 , and  the  gust  disturbance  vector,  w . Thus,  in  this  case  the 

• O 

unsteady  aerodynamic  representation  increases  the  dynamic  order  of  the  model 
significantly. 

For  the  Initial  ACT  Airplane,  the  approximate  transformation  from  frequency-  to  time- 
domain  representations  of  the  aerodynamic  forces,  except  for  gust  inputs,  is  accomplished 
with  a least-square  fit  of  a second-order  polynomial  in  the  Laplace  variable  s.  This  leaves 
the  steady  and  unsteady  aerodynamic  forces  as  functions  of  displacements  and  the 
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corresponding  first-  and  second-order  time  derivatives.  This  formulation  does  not 
increase  the  dynamic  order  of  the  systehn.  The  unsteady  effects  associated  with  gust 
inputs  are  approximated  with  Kussner  lift  growth  functions.  These  are  handled  by 
introducing  unsteady  aerodynamic  states  much  the  same  way  as  for  the  DAST  2 model. 
The  state  model  of  the  flexible  airplane  takes  the  form 

= A3X3  + BgU  + TgWg  (E-1) 

where  x , u,  and  w are  the  state,  control  surface,  and  gust  velocity  vectors,  respectively. 
^ § 

Figure  E-6  shows  with  more  detail  the  linear  state  models  for  the  DAST  2 and  Initial  ACT 
Airplanes.  In  the  case  of  the  DAST  2 model,  the  state  vector  was  transformed  from 
moving-inertial  to  body-fixed  axes.  This  transformation  is  shown  in  Figure  E-7,  and  the 
inertial-to-body  axis  transformation  matrix,  P,  is  shown  in  Figure  E-8. 


= Va  + BgU 

+ r.w. 
a g 

DAST  2 

’‘a  = 

1 

q 

p 

5 

and  u = 

[t] 

L 9 j 

Initial  ACT  Airplane 

’‘a  = 

1 1 

CO  ' 

1 J 

and  u = 

1 1 
1 1 

Figure  E-6.  State  Models— Flexible  Airplane 
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Airplane  dynamics 
Output  equations 


Vi  + BgU  + r^Wg 

y = CgX,  + DgU  + EaWg 

Let 

Airplane  dynamics 

= P"’ AgPxB  + P‘''BaU  + P'^FaWg 
y = CgPxg  + DgU  + EgWg  Output  equations 

where 

X|  = state  vector  moving-inertial  axis  coordinates 
Xg=  state  vector  body-fixed  axis  coordinates 
P = inertial-to-body  axis  transformation  matrix 

Figure  E-7.  Axis  Transformation— Drone  for 
Aerodynamic  and  Structural 
Testing  2 (Symmetric  Equations 
of  Motion) 


Inertial  Body 


z * vertical  velocity 

0 * pitch  angle 

f-j , 23,  ” unsteady  aerodynamic  states  associated  with  z 

^ ^3'  ^4  ° unsteady  aerodynamic  states  associated  with  0 

V * true  velocity 

G y , 62*  G3,  » constants  associated  with  representations  of  unsteady  aerodynamic  forces 

G,  =Vb; 

1 = identity  matrix 

Figure  E-8.  Inertial-to-Body  Axis  Transformation  Matrix— Drone  for 
Aerodynamic  and  Structural  Testing  2 
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E.1.2  QUASI-STATIC  AEROELASTIC  AIRPLANE  MODELS 


The  quasi-static  aeroelastic  (QSAE)  models  were  used  for  the  design  of  the  pitch- 
augmented  stability  (PAS)  system.  The  QSAE  model  for  each  flight  condition  is  a state 
model  consisting  of  four  first-order  differential  equations.  The  state  equations  are  shown 
in  terms  of  the  dimensional  derivatives  in  equation  (E-2). 


where  the  state  vector,  x , in  stability  coordinates  has  elements 

u = incremental  forward  velocity  (m/s) 
ot  = incremental  angle  of  attack  (rad) 
q = incremental  pitch  rate  (rad/s) 

0 = incremental  pitch  angle  (rad) 

and  the  control  input  is 

5 = incremental  elevator  deflection  (rad) 

E 
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The  individual  dimensional  derivatives  in  the  state  model  are 


= dimensional  variation  of  X force  with  speed 
X(^  = dimensional  variation  of  X force  with  angle  of  attack 

X^  = dimensional  variation  of  X force  with  pitch  rate 

g = acceleration  of  gravity 

= dimensional  variation  of  Z force  with  speed 
Zq,  = dimensional  variation  of  Z force  with  angle  of  attack 

Z^  = dimensional  variation  of  Z force  with  angle-of-attack  rate 

Z^  = dimensional  variation  of  Z force  with  pitch  rate 

V = steady-state  airspeed 

= dimensional  variation  of  pitching  moment  with  speed 
= dimensional  variation  of  pitching  moment  with  angle  of  attack 
= dimensional  variation  of  pitching  moment  with  angle-of-attack  rate 
= dimensional  variation  of  pitching  moment  with  pitch  rate 
Xg^  = dimensional  variation  of  X force  with  elevator  angle 

Zgg  = dimensional  variation  of  Z force  with  elevator  angle 

Mgg  = dimensional  variation  of  pitching  moment  with  elevator  angle 

E.1.3  OUTPUT  MODELS 

The  needed  output  models  are  the  displacements,  velocities,  accelerations,  and  loads  at 
various  airplane  stations.  The  first  three  items  are  related  to  the  modal  coordinates,  q, 
and  the  mode  shape  matrix,  $ , as  follows: 


Positions 

y = 4>q 

Velocities 

y = 

(E-3) 

Accelerations 

y = $q 
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The  vector  y is  defined  as 


y = 


yi 

Y2 

ym 


(E-4) 


where  m is  the  number  of  sensor  locations,  and  (i  = 1 to  m)  is  a six -component 
translation  and  rotation  vector  at  the  ith  station  expressed  as 


Vi  = 


Txi 

Tyi 

T^i 

Rxj 

RVi 

RZ: 


(E-5) 


For  the  DAST  2 model,  the  equations  of  motion  and  the  mode  shape  matrix  are  in  moving- 
inertial  coordinates.  The  corresponding  linear  state  models  that  included  the  output 
equations  are  transformed  to  body-fixed  axes.  For  the  Initial  ACT  Airplane,  the  equations 
of  motion  are  expressed  in  body-fixed  axes  while  the  mode  shape  matrix  is  referenced  to 
moving-inertial  axes.  Also,  the  x and  z measurement  axes  are  reversed  with  respect  to 
the  standard  convention  (x  forward  and  z downward).  The  proper  measurement  equations 
are  obtained  by  two  coordinate  transformations  as  shown  in  Figure  E-9. 


The  loads  are  expressed  as  a function  of  the  mode  deflections,  q,  and  load  distribution 
matrix, as  follows: 


L = 


where  the  vector  L is  defined  as 


(E-6) 


fE-7) 
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Then  for  the  measurements  at  the  ith  station 
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% 

Vi 
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0 

0 

T 

V*i 

0 0 S 

0 0 <!>l 

- _ 

‘’b 

where 

= mode  shape  matrix  at  ith  station 
= fixed  inertial  axis  coordinates 
qg=  moving-body  axis  coordinate 
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Figure  E-9.  Axis  Transformation— Initial  ACT  Airplane  (Symmetric  Equations  of  Motion) 


where  p is  the  number  of  load  stations,  and  L-  (i  = 1 to  p)  is  a three-component  vector 
consisting  of  the  bending,  torsion,  and  shear  at  the  ith  station,  expressed  as 


(E-8) 


The  displacement,  velocity,  and  acceleration  measurements  and  loads  are  all  expressed  in 
the  general  form  of  the  state  model  output  equation 


y = CaXg  + DgU  + EaWg 


(E-9) 


where  y is  a vector  of  measurements  and  loads,  x. 
surface  vector,  and  w is  the  gust  velocity  vector. 

O 


is  the  state  vector,  u is  the  control 


EAA  ACTUATOR  MODELS 


Only  linear  actuator  models  have  been  considered  during  the  control  law  synthesis  portion 
of  this  study.  They  are  supplied  as  transfer  functions  that  are  transformed  to  state 
models  in  the  standard  controllable  form.  Figure  E-10  shows  that  the  state  vector 
consists  of  the  surface  position  and  its  first  and  higher  order  derivatives.  The  surface 
deflection  and  the  corresponding  first  and  second  time  derivatives  are  selected  as  outputs 
because  they  are  required  as  inputs  to  the  flexible  airplane  model  described  in 
Subsection  E.2.1.  The  general  form  of  the  model  of  the  complete  actuation  system  is 


®u*^*c  (E-10) 

u = (E-1 1) 

where  x^  is  the  state  vector  for  all  the  actuators,  u is  the  control  surface  vector,  and  u^ 
is  the  control  command  vector.  The  nonlinear  actuator  model  will  be  discussed  in 
Subsection  E.6.2. 
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Transfer  function  form 


5^  = ith  control  surface  command  (scalar) 
5j  = ith  control  surface  position 
State  model  formulation 

• Standard  controllable  form 


• m actuators  are  combined  to  one  actuation  system  model 


Figure  E- 10.  Actuator  Dynamic  Mode! 
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E.1.5  WIND  MODEL 


Because  of  its  simplicity  and  its  ease  in  state  model  realization,  the  Dryden  model  was 
selected  to  represent  gust  disturbances.  Gust  penetration  effects  were  neglected  for  the 
same  reason.  Figure  E-11  shows  the  model  in  transfer  function  form  and  standard 
observable  state  model  form  for  both  the  longitudinal  and  transverse  gust  velocities.  The 
input  is  white  noise,  and  the  output  is  correlated  gust  velocities  that  have  the  Dryden 
power  density  spectrum.  The  general  form  of  the  gust  disturbance  model  is 


Wg 


(E-12) 

(E-13) 


where  is  the  wind  state  vector,  w^  is  the  white  noise  input  scalar,  and  Wg  is  the  gust 
velocity  vector. 


• Longitudinal  gust  veiocity  u: 


Wg(s) 

<^uV^  1 

u(s) 

(7u'^s+l) 

= [-Tu] 

u(t)  =[l]xyy{t) 


Transverse  gust  velocities  v,  w: 


v(s),  w(s) 


= 


0|-7, 


V,  w 


Xvv(t) 


where 


Li!-27v.w- 

wV  ”*^v,  w 

LV^.w 

v(t),w(t)  =[o  lj  X^(t) 


v,w 


Wp(t) 


”^u  “■{“  ' ^v,  w ~r 

“■U  ^v,  w 

w_  = white  noise  of  unity  intensity 
c 

V = true  airspeed 

= longitudinal  turbulence  scale  length 
vv  “ turbulence  scale  lengths 

Oy  = longitudinal  rms  gust  intensity 
CTv  w ~ transverse  rms  gust  intensities 
s = Laplace  variable 

Figure  E- 1 1.  Dryden  Turbulence  Models 
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E.2.0  EIGENVALUE  AND  EIGENVECTOR  COMPUTATION 
AND  BLOCK  DIAGONAL  TRANSFORMATION 

E.3.0  RESPONSE  CALCULATION 
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E.2.0  EIGENVALUE  AND  EIGENVECTOR  COMPUTATION 
AND  BLOCK  DIAGONAL  TRANSFORMATION 

The  stability  and  response  characteristics  of  a linear  aeroelastic  system  represented  by  a 
state  model  are  completely  described  by  the  associated  eigenvalues,  eigenvectors,  and  the 
input  and  output  distribution  matrices.  Consider  a state  model  of  the  general  form 

X = Ax  + Bu  + Fw  (E-14) 


where 

X is  an  n X 1 state  vector 
u is  an  m X 1 control  vector 
w is  a p X 1 disturbance  vector 
A is  an  n X n state  matrix 
B is  an  n X m control  distribution  matrix 
r is  an  n X p disturbance  distribution  matrix 

The  eigenvalues  of  the  system  are  the  n values  ofX=  (X^  X^,  ...  X^)  that  satisfy  the 
equation 


det(Xl-A)=0  (E-15) 

where  1 is  an  n x n identity  matrix  and  det(X  I-A)  means  the  determinant  of  the  argument. 

The  eigenvectors  v.  (i  = 1,2,  ...  n)  of  the  system  are  defined  by  the  relation 

Avj  = XjVj  i=l,2,  ...n  ' (E-16) 

If  Xj  is  a complex  eigenvalue,  then  the  corresponding  eigenvector  v.  is  also  complex. 
Because  the  state  matrix  A is  real,  it  can  be  shown  that  complex  eigenvalues  and 
eigenvectors  always  occur  in  conjugate  pairs.  The  complete  eigensystem  consists  of  n 
eigenvalues  X.(i  = 1,  2,  ...  n)  and  the  corresponding  n eigenvectors  v.(i  =1,2, ...  n). 
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Consider  a similarity  transformation  T of  the  form 


T=  [viv2...v„]  (E-17) 

whose  columns  are  the  eigenvectors  of  the  matrix  A.  Let 

n 

x = Tz  = 2 ZjVj  (E.jg) 

i=l 

where  (scalar)  is  a transformed  coordinate  of  x in  the  direction  of  the  eigenvector  v.. 
The  matrix  T of  the  similarity  transformation  is  complex  and  so  are  the  matrices  of  the 
transformed  state  model 

z = Az + (T  *B)  u + (T'^Dw  (E-19) 


where  A is  a diagonal  matrix  whose  diagonal  elements  are  the  eigenvalues 
Xj  (i  = 1,  2,  . . . n) 


i.e., 


A = r’AT  = 


(E-20) 


An  alternate  form  of  the  transformed  system  that  avoids  use  of  complex  matrices  can  be 
obtained  using  a new  similarity  transformation  matrix,  T,  whose  columns  now  consist  of 
the  following  vectors 


T - [t,t2  ...  ...  t„J  (E-21) 

where  the  elements  of  the  vectors  t-  (i  = 1,  2,  ...  n)  are  all  real  and  defined  as  follows. 
For  any  real  eigenvalue  X.,  the  vector  tj  is  equal  to  the  eigenvector  v.,  while  for  any 
complex  eigenvalue  Xj  and  its  conjugate  Xj^^  (=X.),  the  vectors  tj  and  tj^^  are  given  by 

tj  = Re(v;)  + ImiVj) 
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and 


tj+i  = Re(Vj)- Im(vj) 

where  Re(-)  and  Im(-)  denote,  respectively,  the  real  and  complex  part  of  the  argument. 
The  matrix  A is  transformed  by  this  similarity  transformation  into  a block  diagonal  form 


(E-22) 

n/2  < r < n 


A = r‘AT  = 


All 


Ta'j^ 

1. 


|Ar 


X . is  block  diagonal  with  1 x 1 blocks  for  real  eigenvalues  and  2x2  blocks  for  complex 
conjugate  pairs  of  eigenvalues;  i.e.. 


and 


for  real  Xj  = a•^ 


Ai  = 


''1 

CJ; 


for  the  complex  conjugate  pairs 


Xj  = ai+ja)j  and  Xj+j=Oj-j<Oj 


(E-23) 


(E-24) 


The  complete  state  model  in  block  diagonal  form  is  expressed  in  terms  of  the  modal 
coordinate,  z,  as 


z = (T'*AT)z  + (T*^B)u  + {T"’r)w  (E-25) 

y = (CT)z  + Du  + Ew  (E-26) 
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E.3.0  RESPONSE  CALCULATION 


Traditionally,  the  frequency -domain  power-spectral-density  technique  has  been  widely 
used  to  compute  steady-state  gust  responses.  This  technique  requires  determination  of  a 
complex  frequency  response  matrix  relating  gust-velocity  inputs  to  output  response 
variables  and  computation  and  integration  of  a large  number  of  power  and  cross  spectra. 
For  a flexible  airplane  with  a large  number  of  lightly  damped  modes  that  are  subjected  to 
distributed  random  gust  inputs,  these  calculations  are  costly  and  require  careful  modeling 
for  accuracy.  Using  an  option  in  the  QR  program  (ref  E-2),  this  technique  has  been  used 
to  compute  the  output  power  spectral  density  for  a limited  number  of  gust  loads.  The 
purpose  of  expressing  the  loads  as  a function  of  frequency  is  to  establish  the  required 
bandwidth  of  gust  control  laws  and  understand  the  significant  frequency  content  of  the 
loads.  For  the  majority  of  the  response  calculations,  root-mean-square  (rms)  responses 
generate  the  most  interest.  In  the  present  study,  these  responses  are  obtained  by 
computing  correlation  matrices  for  the  steady -state  responses  due  to  random  gust  inputs. 

Time  history  simulation  of  the  airplane  dynamic  response  is  a necessary  part  of  evaluating 
system  performance.  Time  history  response  calculation  is  accomplished  using  a state 
transition  matrix  approach.  By  incorporating  the  block  diagonal  form  of  the  system 
matrix,  this  technique  is  more  efficient  and  accurate  than  existing  methods  for  simulation 
of  linear  systems.  Load  responses,  control  surface  activities,  and  the  time  histories  of 
other  performance  variables  can  be  calculated  in  response  to  various  inputs  such  as  pilot 
commands  and  random  and  discrete  wind  gusts. 

E.3.1  COVARIANCE  ANALYSIS  FOR  ROOT-MEAN-SQUARE  RESPONSE 

A new  approach  is  used  to  compute  the  steady-state  response  correlation  matrices  of  a 
dynamic  system  subjected  to  random  inputs.  This  method  avoids  computational 
difficulties  and  inaccuracies  associated  with  lightly  damped  modes,  approximate  gust 
penetration  effects,  and  the  finite  frequency  range  for  integration.  The  calculations  are 
performed  using  time-domain  state-space  representation  of  the  airplane  model.  A 
transformed  covariance  matrix  is  obtained  by  computing  convolution  integrals.  The 
values  of  the  integrals  can  be  evaluated  in  closed  form  for  white  and  Dryden  spectra, 
among  others.  Gust  penetration  effects  as  the  airplane  traverses  the  field  of  atmospheric 
turbulence  are  modeled  by  pure  time  delays,  avoiding  the  use  of  Fade  approximations. 
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Atmospheric  turbulence  in  general  is  represented  by  a set  of  three-dimensional  random 
velocity  components.  The  gust  velocities  encountered  at  point  r (measured  with  respect 
to  the  aircraft  frame)  are  given  by  (r  + Vt,  t),  where  V is  the  true  airspeed  vector.  The 
various  gust  velocity  input  vectors  at  different  stations  are  combined  to  form  the  single 
gust  vector 


Wg(t) 


w (rj+vt,t) 

Wg(r2+Vt,t) 

Wg(ru^+Vt,t) 


(E-27) 


where  m is  the  total  number  of  points  at  which  gust  forcing  functions  are  applied.  Only 
deviations  from  the  mean  wind  velocity  components  are  considered  in  the  gust  input;  i.e., 
E [ w (t)]  = 0,  where  e[*]  is  the  expected  value  operator  of  the  ensemble  average.  Then, 
by  definition,  the  time-lag  cross-correlation  functions  between  velocity  components  of 
w (t)  measured  at  the  various  points  may  be  written  as 

O 


(R(r)=EWg(t+T)W, 


“R(rj  j + Vr.r)  ...  R(rj,^  + V t,  r)  “ 

• • 

• • 

• • 

_R(r,^]  + Vt,  t)...  R(r,„,^  + Vt,  t)_ 


(E-28) 


The  ijth  element,  R(r  - + Vt,t),  isa3x3  correlation  matrix  given  by 

R(rjj+VT,T)  = E [wg(rj+V(t+T),t+r)wT(rj+Vt,  t)]  (E-29) 

and  r-j  = r.  - rj  for  i,j  = l,m. 

It  can  be  shown  that  if  the  true  airspeed,  V,  is  large  enough,  then  R(rjj  + Vt  , t)  is 
effectively  independent  of  its  explicit  time  argument,  t,  so  that 

R(rij+VT,T)  = R(rjj+VT,0)  (E-30) 
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This  equation  expresses  what  is  commonly  termed  Taylor's  hypothesis  and  is  valid  under 
typical  flight  conditions.  In  isotropic  turbulence,  the  kith  element  of  the  3 x 3 correlation 
matrix  R(r-  + V r , 0)  can  be  expressed  in  terms  of  two  correlation  functions,  f(  t ) and 
g(  T ),  as 

Rki  (rij  + Vr,0)  = a-([fa)-g(S)]i!^  +g($)5ki^  (E-31) 

where 

5 = rjj  + Vr  (E-32) 

1^1  = + ^;  + (E-33) 


2 . 

a IS  the  mean  square  turbulence  intensity 
(i  = 1,3)  is  the  ith  cartesian  component  of  ^ 
5,  , is  the  Kronecker  delta: 


5kl 


l,k  = 1 
O.k  ^ 1 


(E-34) 


and  f(S  ) and  g($  ) are  the  longitudinal  and  transverse  correlation  functions,  respectively. 
The  von  Karman,  Dryden,  band-limited  white  noise,  and  white  noise  turbulence  models 
have  correlation  functions  of  the  forms  shown  in  Figure  E-12. 

Consider  a state  model  of  the  following  form 

x(t)  = Ax(t)  + rwg(t)  (E-35) 

The  initial  conditions  are  x(o)  = x^,  where  E [x^  ] = 0 and  E [x^Wg^(t)  j = 0.  This  means 
that  the  initial  conditions,  x^,  have  zero  mean  values  and  are  not  correlated  with  the  wind 
disturbance  inputs  w (t)  for  all  time  t.  The  system  output  variables  are  written  as 

O 

y(t)  = Cx(t)  (£.3(3) 
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Figure  E- 12.  Von  Karman,  Dryden,  Band-Limited  White  Noise,  and  White  Noise  Correlation  Functions 
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Assuming  that  A is  a stable  matrix,  the  equation  has  a steady-state  solution  X{«)  = lim 

— t>00 

X (t),  which  satisfies  the  algebraic  matrix  equation 


AX  (oo)  + X (oo)  = 


c °° 

1 exp  [Au]  r (R(u)r^du  - 

r riRT'dDr'Texp 

A^u 

J 0 

' 0 

(E-38) 


The  solution  of  X(«)  from  equation  (E-38)  can  be  obtained  efficiently  using  a modified 
version  of  the  Bartel's  and  Stewart's  algorithm,  with  the  exception  that  the  orthogonal 
similarity  transformation  of  the  matrix  A to  real  Schur  form  has  been  replaced  by  a 
transformation  to  block  diagonal  form.  The  latter  allows  the  indefinite  integral  on  the 
right-hand  side  of  equation  (E-38)  to  be  evaluated  in  closed  form  for  the  Dryden  and  white 
noise  turbulence  models.  Numerical  integration  may  still  be  required  for  other  types  of 
turbulence  models  such  as  von  Karman  and  band-limited  white  noise.  An  efficient 
algorithm  was  developed  to  compute  the  incomplete  Laplace  transform  of  von  Karman 
turbulence.  It  is  described  in  Subsection  E.3.2. 


In  terms  of  the  block  diagonal  transformation,  T,  which  is  described  in  Section  E.2.0,  the 
system  state  transition  matrix  exp'(Au)  is 

exp  [Au]  = T exp  [Au]  (E-39) 


where 


exp  [Au]  = 


’exp  [Aj  u] 
exp  [At  u] 

0 


exp  (Af  u] 


or 


exp[Ajii]  =J 


exp  (aj  u)  . Xj  = aj 

exp  (aj  u)  cos  wj  u -exp  (oj  u)  sin  uj  u ' 

l^exp  (aj  u)  sin  cjjU  exp  (aj  u (cos  ojju 


(E-40) 


.Xj  - Xj+i  =aj+jcjj 
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Using  equation  (E-39),  the  indefinite  integral  in  equation  (E-38)  simplifies  to 


f exp  [Au]  P(R(u)r^  du  = T f exp  [Au]  T'^  P(R(u)r^  du 
o o 

P P _ X 

= T 2 2 (RijT^rAjjr^ 
i=l  j=l 


(E-41) 


where  A-j  is  a p x p matrix  whose  kith  element  is  equal  to  6|^|  5^^,  and 


OO 

J exp  I I du 


(E-42) 


Note  that  p = 3m  for  a three-dimensional  turbulence.  The  correlation  function  (R-(u)  is  as 
defined  in  equation  (E-28).  It  can  be  shown  that  the  integration  involved  in  equation 
(E-41)  reduces  to  the  evaluation  of  the  Laplace  transforms  of  the  respective  correlation 
functions,  <R”(u),  which  in  turn  depends  only  upon  two  scalar  functions  f(  S ) and  g(  ^ ). 
The  Laplace  variable  s of  the  transforms  is  evaluated  at  the  system  eigenvalues 
X.(i  = l,n).  In  this  case,  the  Laplace  transform  is  defined  as 


£f(Rjj  = f (Rjj(u)  exp(su)  du  (E-43) 

where  the  region  of  convergence  lies  in  the  left  half  of  the  complex  s-plane;  i.e., 
Re(s)  < 0,  which  is  identical  to  the  domain  of  system  stability.  Thus,  this  approach 
eliminates  the  need  for  numerical  integration  when  analytic  expressions  for  the 
transforms  of  the  longitudinal  and  transverse  correlation  functions,  f(  ^ ) and  g(  ^ ), 
respectively,  are  available.  Gust-penetration  effects  are  included  by  introducing  a time 
shift  in  the  argument  5 of  the  correlation  function  as  shown  in  equation  (E-32).  The 
argument  5 is  further  simplified  by  assuming  that 

1^1  . I^sl  « l^ll 
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This  approximation  implies  that  the  spanwise  correlations  between  gust  stations  are 
perfect  and  only  gust  penetration  in  the  longitudinal  direction  is  considered.  The 
argument  of  the  correlation  function  takes  on  the  simplified  form 

S = I (Xj  - Xj)  + V jrl  (E_44) 

The  Laplace  transforms  of  f(  S ) and  g(  | ) for  the  Dryden  and  white  noise  turbulence 
models  are  shown  in  Figure  E-13.  Subsection  E.3.2  describes  the  procedures  whereby  gust 
penetration  effects  can  be  included  for  the  case  of  the  von  Karman  turbulence  model. 


Using  block  diagonal  transformation  A = T ^AT  and  equation  (E-41),  the  algebraic  matrix 
equation  (E-38)  becomes 

P P 

'T'  * ~ 1 1 'T' 


AZ  + ZA^  = - 2 2 ^ FAjj  (T ^ 

i=l  j=l 

- ^ 2 2 fijjr  1 FAjj  (T  ‘ D’^y 


(E-45) 


-1—  -T 

where  Z = T X(  «*>  )T  . The  system  of  linear  equations  in  Z-j  arising  from  the  matrix 
equation  (E-45)  is  partitioned  and  solved  using  the  Grout  reduction.  Solutions  for  the 
steady-state  covariance  matrix  X(«)  are  given  by 


X(oo)  = T Z T ' 


(E-46) 


Similarly,  the  steady-state  covariance  matrix  for  the  system  response  rate  x(t),  defined  as 
X'  (oo)  = lim  E [x(t)xMt)| . is  computed  directly  from  an  equivalent  matrix  Z'.  It  is  given  by 

t-^oo 


X'{~)  = T Z' t"^ 


(E-47) 


where  the  matrix  Z'  satisfies  the  equation 


P P 

z = AZ  a"^  + r * rfl(0)(r^  + a 2 2 fiy-r ^ rAy  (r^  d’*' 

i=l  j=l 

+ ^A  2 2 (RyF^  rAy(r' 


(E-48) 
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Figure  E- 13.  Laplace  Transforms  of  the  Longitudinal  and  Transverse  Correlation 
Functions  for  the  Dryden  and  White  Noise  Turbulence  Models 


The  solution  of  the  matrix  X'(“>)  provides  a means  to  compute  the  steady-state 
covariance  for  variables  such  as  velocities  and  accelerations.  Finally,  the  covariance 
matrices  for  the  performance  variables  described  in  equation  (E-36)  and  their  rates  are 
calculated  from 

Y (oo)  = lim  Ely  (t)y^  (t)]  = CX  (°°)C^ 


i'(=o)  = limE[y(t)yT(t)]  =CX'(~)C'T 

t oo 

respectively. 


(E-49) 


(E-50) 
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E.3.2  INTEGRAL  REPRESENTATION  OF  INCOMPLETE  LAPLACE  TRANSFORM 
OF  VON  KARMAN  TURBULENCE  CORRELATIONS 


Computation  of  gust  covariance  described  in  Subsection  E.3.1  requires  knowledge  of  the 
incomplete  Laplace  transform  of  the  gust  correlation  function  p(t).  For  the  Dryden 
turbulence  model,  integration  can  be  performed  in  closed  form  as  shown  in  Figure  E-13. 
The  computational  procedure  becomes  complicated  for  the  more  realistic  von  Karman 
turbulence  model.  The  correlation  function  of  such  a turbulence  model  involves 
evaluation  of  modified  Bessel  functions  of  the  second  kind.  Numerical  integration  of 
these  functions  is  cumbersome.  An  alternative  method  will  be  presented  that  requires 
only  numerical  integration  of  products  of  elementary  and  exponential  functions. 


The  von  Karman  power-spectral-density  functions  are  of  the  form 


_J_ 

2ir 


for  the  longitudinal  gust  components  and 


a2 

(1  + b2cj2)  Q 


<I>2(co) 


1 


2ir 


for  the  transverse  gust  components  where 


C^(l  + D^g;^) 
(1  + 


D 


V 


6 


5 

6 


a = 1.339 


L = turbulence  scale  length 
a = turbulence  rms  intensity 


(E-51) 


(E-52) 
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It  can  be  easily  shown  that  equations  (E-51)  and  (E-52)  are  in  fact  the  output  power 
spectral  densities  of  the  following  linear  filters,  when  driven  by  white  noise  input, 


__A 

1^1  (s)  = (1  + Bs)® 


(E-53) 


and 


C(1  +Ds) 

^2^®)  ^ (1  + 


(E-54) 


respectively. 

The  impulse  response  function  of  the  linear  filter  h^(s)  is  given  by  the  following  integral 
representation; 

hj(t)  r(0)-lr(l-0)  /“  e-(«+l)t/B  u-«du  (E-55) 

From  equation  (E-55),  the  linear  filter,  equation  (E-53),  can  be  seen  as  being  a 

combination,  in  parallel,  of  a continuum  of  first-order  lag  filters  with  poles  located  at 

-(u  + 1)/B  and  corresponding  residues  Ap(0)-lr(i^)-lu'^du  for  (Ku<<»  . 

B 

From  equation  (E-55),  the  von  Karman  correlation  function  for  the  longitudinal  gust 
component  can  be  represented  (ref  E-3) 

OO 

P](t)  = y*hj(s)  hj(s+t)  ds  (t>0) 

s=0 

= (—)  ney^ni-B)  V//  g-{u+l  )s/Bu-0g-(y+l  )(s+t)/By-0dudyds  (E-56) 

' B ' 

2 

= — r(0)'^r(l-5)'^  (u+y+2)‘^u‘®y"^dudy 

B 

The  incomplete  Laplace  transform  of  the  correlation  function  pj(t)  is  given  by 

A 

rj(A,X)  = / e'^V(t)  dt 

o 

2 

= — ney'^ro-dy^fj  d-e'  [(y+D/B+x]  A)|jy+}y3+)j-i(u+y+2)'i  (E.57) 

B 

• u'^y'^dudy 
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To  simplify  this  expression,  the  following  equality  was  used: 


uu 

J'  u"^(u+a)‘^  du  = ira‘^/sin7r0 
u=0 

Integrating  out  the  variable  u in  equation  (E-57)  using  equation  (E-58)  to  get 


CE-58) 


•l(A,X)  = K / y%+2r^((y+l)/B+Xrkl-e*  dy 

y=0 


(E-59) 


where 


2 

K = J^ney'^ni-ey^ismits  = i-nnsiey'^niiey^  — 

B B 

The  integrand  in  the  right-hand  side  of  equation  (E-59)  involves  only  elementary  and 
exponential  functions;  therefore,  the  numerical  integration  can  be  easily  performed.  Due 
to  a discontinuity  at  y = 0 of  the  function  y”  in  the  integrand,  the  ordinary  Simpson's  rule 
is  modified  to  avoid  numerical  inaccuracies  near  the  origin.  The  procedure  is  described  in 
the  following  paragraphs. 


The  integral  in  equation  (E-59)  can  be  rewritten  as 

OO 

I(X,A,0)  = K y*  y"®f(y)  dy  (E-60) 

y=0 

where 


f(y)  = (y+2)‘^(  (y+l)/B+X)‘^(l-e‘[(y+^)/fi+^]  ^)  (E-61) 

Let  yQ  = 0,  y^  ...,  y2^  be  a chosen  grid  for  the  numerical  integration  of  equation  (E-60). 
On  the  interval  y^,  y.^2  where  i = 0,  2,  4,  ...  , the  function  of  f(y)  can  be  approximated 
by  a second-degree  polynomial 


p(y)  = r(yi)(y-yi+i)(y*yi+2)/(yi*yi+i)(yryi+2) 

+ f(yi+i)(y-yi)(y*yi+2)/(yi+i*yi)(yi+ryi+2)  (E-62) 

+ f(yi+2)(y-yi)(y-yi+i  )/(yj+2*yi)(yj+2-yi+i ) 
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The  contribution  to  the  integral  in  equation  (E-60)  on  the  interval  j^yj,  J therefore 

ij  = f(yi)S(yi,yi+2,yi+i.yi+2)/(yryi+P^yryi+2) 

+ f(yi+2)S(yi.yi+2.yi’yi+2)/(yi+ryi)(yi+ryi+2^  (e-63) 

+ f(yi+2)S(yi.yi+2*yi»yi+i  )/(yi+2-yi>(yi+2-yi+i ) 


where 


b 

S(a,b,c,d)  =j*(y-c)(y-<l)y*^dy 
a 

= (b3-®-a3-^)/(3-0)  - (c+d)(b2-®-a2-<^)/(2-^) 

+ cd(b^-^-al-^)/(l-5) 

The  incomplete  Laplace  transform  in  equation  (E-57)  becomes 


N 

ri(A,X)  = I(A^,0)  ^ K ^ Ij 

i-0 


(E-64) 


Using  this  approach,  fast  convergence  of  the  integration  is  achieved.  For  typical  time 
delay  constants  encountered  in  gust  penetration,  turbulence  scale  length,  airspeed,  and 
range  of  rigid  and  flexible  airplane  dynamic  modes,  the  number  of  integration  points 
N = 100  was  sufficient  for  the  accuracy  required  to  compute  gust  response  covariance 
matrices.  The  coefficients  of  f(y)  in  of  equation  (E-63)  need  only  to  be  evaluated  once 
for  the  grid  y^,  ...  , y2^,  after  which  the  incomplete  Laplace  transform  defined  in 
equation  (E-57)  can  be  simply  computed  for  various  values  of  A and  X . 


The  linear  filter  h2(s)  shown  in  equation  (E-54)  can  be  rewritten  in  the  following  form; 


h2(s) 


C 

(1+Bs)^ 


^ (1-D/B) 

B 1+Bs 


(E-65) 
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Its  impulse  response  function  h2(t)  is  equal  to 

h7(t)  = -^h,(t)  + — ^ (1-D/B)  h,(t)*e-t/B 

AB  ' AB  , 

where  h|(t)  is  the  longitudinal  Impulse  response  function  introduced  in  equation  (E-55)  and 
* signifies  the  convolution.  It  follows  from  this  that 

CD  C 

" ”aF "aF  (E*67) 


where 


A C °° 

hT(t)  = r(0r^r(l-0)*M  u-^du 

® *'u=0 

hj(t)  = A r(0rIr(l-0)-J  (e-t/B  - du 

J e\ 


(E-68) 


Starting  from  equation  (E-67)  and  proceeding  in  the  same  manner  as  shown  previously,  the 
following  is  the  integral  representation  for  the  incomplete  Laplace  transform  of  the 
transverse  correlation  function  P2(t)  defined  by 

OO 

h2(s)  h2(s+t)ds  (E-69) 

=0 

is  obtained.  It  is  given  by 


rolA.X)  = / e*^^P2(t)dt 

*0 

(ab)  ^"^(ab") 

^ (■^)  ’ O"’  • 'tt 
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where 


3 j j = r^(A , X)  = incomplete  Laplace  of  the  longitudinal  correlation  function 


IT 


f°°  «4.n 

■ i.e-(X+l/B)A 

l^-(X+(y+l)/B)A" 

\ 

2®  (X+l/B) 

(y+2)®(X+(y+l)/B)  _ 

dy  (E-71) 


J-n  = BK  /*  (]^-(X-Ky+I)/B)A) 

y=0  X+(y+l)/B 


dy 


(E-72) 


and 


JTt 


r 

y=o 


= BK  / y-(0  + l) 


l.e-(X+l/B)A  j_^-(X-Ky+l)/B)A 
2^+'  (X+l/B)  (y+2)^+l(X-Ky+l)/B) 


dy  (E-73) 


Equations  (E-71),  (E-72),  and  (E-73)  can  be  numerically  integrated  using  the  same 
algorithm  described  previously.  It  should  again  be  emphasized  that  the  computation 
involves  only  simple  summations  of  elementary  and  exponential  functions. 


The  approximate  gust  penetration  effects  described  in  Section  E.3.0  can  be  easily 
accommodated  using  the  preceding  incomplete  Laplace  transforms.  For  a delay  time 
constant  A,  the  Laplace  transforms  of  the  correlation  functions  with  this  delay  shift  are 
computed  from 

R(A,s)  = J*  e'®Vj(t+A)  dt  (i=l,2) 

o 


e‘S'^Pj(u)du  + (u)du) 

e*^'^Pj(u)du  - J’Q'^e'^“pj(u)du) 

[rj(~,s)  + rj(-A,-s)] 

[ri(oo,s)  - q(A,s)] 


, A < 0 

, A > 0 

; A < 0 
, A > 0 


(E-74) 
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where  r^(*,*)  are  the  incomplete  Laplace  transforms  of  von  Karman  correlation  functions 
given  in  equations  (E-59)  and  (E-70)  for  the  longitudinal  and  transverse  gust  components, 
respectively. 


E.3.3  LINEAR  SIMULATION  ALGORITHM 


The  linear  dynamic  model  can  be  expressed  in  state-variable  form  as 

x(t)  = Ax(t)  + Bu(t)  (E-75) 

where  the  state  vector  x(t)  may  consist  of  the  rigid  and  flexible  airplane  modes,  actuator 
states,  and  controller  states  and  u(t)  is  the  input  vector  consisting  of  pilot  commands  to 
the  control  surface  and  gust  input.  The  output  response  variables  are  contained  in  the 
vector  y(t)  and  given  by 

y(t)  = Cx(t)  + Du(t)  (E-76) 

Equations  (E-75)  and  (E-76)  are  rewritten  using  the  block  diagonal  similarity 
transformation 

x = Tz  (E-77) 


to  get 


z(t)  = Az(t)  + B'u(t) 


(E-78) 


and 


y(t)  = C'z(t)  + Du(t) 


(E-79) 


where  A = T“^AT,  B'  = T"^B,  C'=  CT,  T is  the  block  diagonalization  transformation 
matrix,  and  A is  the  block  diagonal  system  matrix  (see  sec  E.2.0). 

The  transition  of  the  system  modal  responses  z(t)  from  time  t to  t + At  is  given  by 

t+At 

z(t+At)  = e-'^^^z(t)+  J"  e^^^'^'^^“'’’^Bu(T)dT  (E-80) 

t 
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where  e^^^  is  the  modal  state  transition  matrix.  It  is  also  given  in  block  diagonal  form  by 


.A  At  _ 


.Al 


At 


.A2 


At 


: At 


where 


= e for  real  eigenvalue  Xj  = Oj 


and 


A:At 

i » 


a:At 

e ‘ cos  oj 


jAt  sin  wjAt 


, a:At  A* 

e ‘ sin  cjjAt  e * ‘'°s  c*^jAt 


(E-81) 


(E-82) 


for  complex  conjugate  pair  of  eigenvalues  = Xj^j  = a^+  jWj.  If  again  a constant  input 

in  the  time  interval  between  t and  t + At  is  assumed,  equation  (E-80)  becomes 


t+At 


z(t+At)  = e^  ^^z(t)  + u* 


(E-83) 


or 


z(t+At)  =<^z(t)  + 0u* 


(E-84) 


where  u*  being  some  value  of  the  input  function  in  the  interval  [t,  t + Atj.  Evaluation 
of  the  integral  of  the  transition  matrix  can  also  be  performed  in  closed-form  based  on  the 
system  eigenvalues  Xj  (i  = 1,  n).  It  is  given  by 


t+At 

/ eA(t+At-T)  = 

t 


(E-85) 
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where 


and 


a:At 
le  ‘ 


1)  for  real  eigenvalue  Xj  = aj 


Ii  = 


“i 


a: 


(E-86) 


for  complex  conjugate  pair  of  eigenvalue  Xj  = Xj_^^  “ ^i  '''  j^i*  parameters  a.  and 
are  determined  by  the  following  expressions: 


a:At  a:At 

_CTj(l-e  ' cos  cojAt)  + coj  e * sin  cojAt 


Oi; 


^i  = 


-)  -> 
aj'  + Wj- 

. (J;At 

cjj(l-e  cos  cojAt)  + CTj  e ‘ sin  tJjAt 

Uj-  + COj- 


(E-87) 


If  the  responses  of  the  original  states  are  required,  they  can  be  readily  included  as  part  of 
the  output  vector  y(t)  through  the  use  of  the  block  diagonal  transformation  T;  see 
equation  (E-77).  With  the  formulation  stated  in  equation  (E-81),  the  transition  of  the 
system  modal  responses  z(t)  from  time  t to  t +At  involves  only  multiplication  of  a sparse 
matrix. 

For  an  nth-order  system,  the  total  number  of  operations  at  each  integration  step  is  at 
most  2n  multiplications  and  additions  plus  n multiplications  and  additions  for  each  input. 
This  compares  with  n^  and  n,  respectively,  for  a system  that  is  not  block  diagonalized. 
For  high-order  systems  with  small  time  increments,  the  cost  saving  is  substantial. 
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E.i^.O  MODEL  REDUCTION 


The  open-loop  dynamic  model  must  be  simplified  prior  to  the  design  of  a practical 
controller  for  a flexible  airplane.  Likewise,  any  high-order  Kalman  filter  that  has  been 
synthesized  based  on  either  a full-order  or  reduced-order  open-loop  model  must,  in  most 
cases,  be  simplified  before  it  is  implemented  in  the  flight  computers.  In  both  cases,  the 
purpose  is  to  reduce  the  order  to  a level  consistent  with  computational  capabilities  while 
preserving  the  significant  dynamic  characteristics  relative  to  the  control  objectives. 
Many  techniques  are  available,  but  none  will  consistently  produce  accurate  and 
meaningful  results  without  a good  understanding  of  the  inherent  physical  relations  behind 
the  control  task.  Three  methods  and  their  use  will  be  described  here. 

E.4.1  DELETION  OF  NONESSENTIAL  STATES 

Figure  E-1^  illustrates  this  method.  The  dynamic  model  is  reduced  in  size  by  deleting 
rows  and  columns  from  the  state  model  matrices.  If  the  full  model  is  of  order  n,  and  m 
states  are  deleted,  the  reduced  model  is  of  order  n - m.  This  method  is  suitable  for 
deleting  nonessential  states  such  as  the  x and  z rigid-body  displacement  states  from  the 
longitudinal  equations  of  motion.  In  this  case,  perturbations  in  x and  z do  not  produce 
forces  and  moments,  and  the  corresponding  columns  in  the  matrix  A are  filled  with  zeros. 
This  method  can  also  be  used  when  the  deleted  states  are  not  strongly  coupled  with  the 
retained  states.  In  the  case  of  the  phugoid  mode,  the  forward  velocity  and  pitch  angle 
states  can  be  deleted  with  insignificant  impact  on  the  remaining  short-period  and 
structural  modes. 


EA.2  MODAL  RESIDUALIZATION 

This  method  for  model  reduction  is  suitable  for  systems  with  fast  dynamics  that  are  not 
significant  with  respect  to  the  control  task,  or  with  uncontrollable  or  unobservable  modes. 
This  is  typical  for  flexible  airplanes  that  may  have  a large  number  of  stable  high- 
frequency  modes  and  a number  of  weakly  controllable  or  weakly  observable  modes.  The 
dynamic  contribution  of  the  high-frequency  modes  is  generally  not  modeled  very 
accurately,  and  they  need  not  be  controlled  to  meet  closed-loop  design  objectives,  except 
that  the  control  loop  gain  at  high  frequency  must  be  sufficiently  low  so  as  not  to 
destabilize  any  high-frequency  mode.  However,  modal  residualization  retains  the  steady- 
state  effect  of  higher  frequency  modes. 
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• Full-order  state  model: 


• Delete  rows  and  columns  of  matrix  A 

• Delete  rows  of  matrix  B 

• Delete  columns  of  matrix  C 

Figure  E-1 4.  Deletion  of  Nonessential  States 

The  flexible  airplane  is  represented  by  a set  of  linear  time-invariant  system  equations  of 
the  form 


= AgXa  + Ball  + r^Wg 

(E-88) 

y = qxg  + D^u  + EgWg 

(E-89) 

Assuming  that  the  matrix  has  a set  of  n independent  eigenvectors, 

transformed  to  block  diagonal  form  as  described  in  Section  E.2.0. 
system  is  described  by  the  equations 

the  equations  are 
The  transformed 

X = Tz 

(E-90) 

z = T-*AaTz+T"’BaU+T’*raWg 

(E-91) 

y = C^Tz  + Dali  + EaWg 

(E-92) 
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The  transformation  matrix,  T,  is  a square  real  matrix  derived  from  the  column 
eigenvectors  of  A .A  = (T"^A  T)  is  a block  diagonal  matrix  whose  elements  are  the 
eigenvalues  (modes)  of  the  system  matrix  A^,  and  z is  the  modal  coordinates.  The  state 
model  is  partitioned  into  two  sets  of  modes,  z^  and  Z2,  as  shown  in  Figure  E-15.  Having 
ordered  the  modes  so  that  the  upper  partition  contains  low-frequency  modes  and  all 
unstable  modes,  and  the  lower  partition  contains  high-frequency  stable  modes,  it  is 
assumed  that  Z2~0.  The  practical  interpretation  of  this  assumption  is  that  the  modes  Z2 
respond  much  faster  than  the  modes  Zj  and  that  only  the  dynamics  of  z^  are  important 
with  respect  to  the  control  task.  If  Z2  consists  of  i modes,  the  original  nth-order  system 
has  been  reduced  to  an  (n  - i)th-order  system.  The  eigenvalues  of  the  system  are  simply 
those  of  the  retained  modes,  and  the  controllability  and  observability  of  these  are 
unchanged  from  the  original  full-order  model.  The  steady-state  effects  from  the  deleted 
modes  Z2  are  included  in  the  outputs  y through  additional  input  terms. 

E.U.3  LEAST-SQUARE  ERROR  MINIMIZATION 

The  design  of  an  optimal  controller  combines  the  Kalman  estimator  design  with  the 
optimal  gain  matrix  and  generally  has  the  same  order  as  the  dynamic  model  under 
investigation.  The  procedure  of  reduction  using  the  modal  resldualization  technique 
described  in  Subsection  E.U.2  allows  the  designer  to  neglect  fast  stable  dynamic  modes 
and  modes  that  are  weakly  controllable  or  weakly  observable.  The  latter  case  corresponds 

• Full-order  model  (in  block  diagonal  form): 


• Assumption: 

Z2  Ci  0 

• Reduced-order  model: 

= Ai  Z.J  B'lU  + T'^Wg 

Z2  — .-A2  ^ B^2^  “ A2  ^ ^^2^^g 

V = C',Z,  -t-  (Dg  - C'2A2'''b'2)u  -h  (Eg  - C'2A2"''r'2)  Wg 

Figure  E-15.  Modal  Resldualization 
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to  near  pole-zero  cancellations  in  the  controller  transfer  functions.  Even  with  these 
modes  reduced,  the  resulting  filter  may  still  be  too  complex  to  be  implemented  on  a flight 
computer.  This  subsection  presents  a procedure  whereby  a lower  order  filter  can  be 
derived  from  a high-order  controller  while  preserving  the  same  frequency  response 
characteristics  essential  to  the  control  tasks  and  lying  within  the  bandwidth  of  the 
controlled  system.  The  technique  is  based  on  the  curve-fitting  of  filter  single-loop 
frequency  response  against  a specified  model  filter  over  a finite  range  of  frequencies. 

For  example,  suppose  it  is  desired  to  approximate  the  ijth  control  loop  transfer  function 
G(s)  using  a lower  order  filter  G(s,p)  that  retains  the  dominant  characteristics  of  the 
frequency  response  G(jo;)  at  a specified  range  of  frequencies.  To  achieve  this,  a fit  error 
function  E is  defined  to  be  the  integral  of  the  error  square  between  the  actual  and  the 
modeled  filter 


1 r^max  ^ 2 

E(p)  = "^  J |G(jcj)-GGw.  p)l  dco  (E-93) 

“‘^min 

over  a range  of  frequencies  between  cj  • and  If  = 0 and  ® , this 

° ^ min  max  min  max 

error  function  is  also  the  integral  of  the  deviation  square  in  the  impulse  responses  of  the 
filters  G(s)  and  U(s,p),  according  to  the  Parseval's  identity. 

The  set  of  transfer  function  parameters  p is  determined  from  the  minimization  of  the. 
error  cost  function  E defined  in  equation  (E-93).  An  efficient  and  simple  algorithm  has 
been  developed  by  Boeing  to  solve  for  values  of  the  parameter  vector  p.  It  is  based 
mostly  on  the  procedure  described  in  Reference  E-4.  Briefly,  the  method  consists  of  a 
modified  conjugate  gradient  search  to  minimize  the  error  function  using  proper  scaling  on 
the  model  parameters.  Further  constraints  on  the  parameter  signs  are  also  imposed  to 
ensure  consistent  filter  phase  and  gain  characteristics  and  to  maintain  filter  stability 
requirements. 

The  aforementioned  procedures  can  be  applied  to  integrate  design  filters  at  various  flight 
conditions.  This  is  achieved  by  curve-fitting  design  frequency  responses  at  different 
design  points  with  a common  filter  whose  parameters  are  determined  such  that  the 
frequency  responses  closely  match  the  results  of  individual  filters  developed  for  each 
flight  condition. 
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E.5.0  OPEN-LOOP  ANALYSIS 


For  the  open-loop  analysis,  state  models  of  the  airplane,  actuation  systems,  and  wind 
disturbances  are  needed  as  shown  in  Figure  E-16.  All  models  are  full  order  except  for 
deletion  of  nonessential  states.  These  three  models  are  combined  appropriately  to 
perform  the  various  analysis  tasks. 


E.5.1  STABILITY 

Stability  of  the  airplane  rigid  and  flexible  modes  is  determined  by  computing  the 
eigenvalues  of  the  dynamic  models  as  described  in  Section  E.2.0.  This  is  done  for  several 
flight  conditions  and  airplane  mass  distributions. 


• Airplane  dynamic  model 
and  measurement  model: 


"'a  = AgXg  + BgU  + TgWg 

y = ^^a^'a  + DgU  + EgWg 


• Actuation  system  model: 


Xu  = 

^ = CyXy 


• Wind  disturbance  model: 


Wg  = C^x^ 


Combined  state  model  for  analysis: 
where 


X = Ax  + BUj,  + PWg 
y = Cx 


A = 


^a  ®a^u  ^a^w 
0 A^  0 

0 0 


Aw  J 


B = ( r 


w 


C ■ [«a  ‘>aC„  E,C„1 


Figure  E- 16.  Formulation  of  State  Model  for  Open- Loop  Analysis 
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E,5J2  OPEN-LOOP  ROOT-MEAN-SQUARE  GUST  RESPONSES 


For  flight  conditions  where  the  open-loop  airplane  is  stable,  the  steady-state  gust 
response  correlation  matrices  for  the  state;  modal  state;  measurements;  performance 
parameters  such  as  bending  moments,  torsional  moments,  acceleration,  etc.;  and  the 
output  power  spectral  density  of  selected  performance  parameters  are  computed.  The 
computational  techniques  are  described  in  Section  E.3.0.  Because  the  load  equations  are 
based  on  a truncated  set  of  modal  coordinates,  the  load  levels  are  only  approximate. 
However,  because  all  modes  are  included  that  are  significant  with  respect  to  the  control 
task,  these  approximate  loads  were  considered  adequate  to  evaluate  the  relative  merits  of 
various  control  laws. 

For  the  various  correlation  matrices,  the  diagonal  elements  represent  the  variance  of  the 
gust  response  and  the  offdiagonal  elements  represent  the  cross-variance  of  the  gust 
response.  The  significant  frequency  content  of  selected  loads  was  determined  by 
computing  the  load  output  power-spectral-density  functions. 


E.5.3  OPEN-LOOP  LINEAR  SIMULATIONS 

The  linear  simulation  algorithm  described  in  Subsection  E.3.2  was  used  to  simulate  the 
open-loop  airplane.  The  open-loop  equations  are 


®a^u 

■^a" 

"0  “ 

T c ~ 

* a'“w 

- 

+ 

5c  + 

X* 

c 

0 

> 

c 

1 

_^u_ 

0 

(E-94) 


y 


+ 


Dw^.v 


lE-95) 


where  x_  is  the  airplane  state  vector,  defined  in  equation  (E-2),  and  x is  the  state  vector 

a U 

of  the  actuator,  described  in  Volume  I,  Subsection  13.1.2.  The  matrices  A and  B are 

Si  3 

defined  in  Volume  I,  Subsection  13.1.1,  and  is  defined  in  Volume  I,  Sub- 
section 13.1.2.  r is  defined  in  Volume  I,  Subsection  13.1.5,  and  C is  defined  in  Volume  I, 
Subsection  13.1.3.  The  y vector  is  the  output  vector  consisting  of  the  states  and  the 
scalar  n^,  the  normal  acceleration,  expressed  as  a linear  combination  of  the  state 
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variables,  and  the  wind  vector  x , defined  in  Volume  I,  Subsection  13.1.3.  D is  the 

w w 

direct-transmission  matrix  relating  the  output  to  the  wind  disturbance.  0 denotes  a zero 
matrix. 


The  differential  equations  and  output  equations  (E-94)  are  converted  to  a set  of  difference 
equations  in  the  form 


z[(k+l)At]  = 0z  [k(At>]  + 0u* 
y [k(At)l  = C z[k(At)]  + Du* 


(E-96) 


where  z [ k(At)J  is  a set  of  modal  coordinates  and  0 is  a sparse  matrix  as  discussed  in 
Subsection  E.3.7. 


Also, 


(E-97) 


where  5 is  the  commanded  elevator  angle  and  x is  the  wind  state  vector, 
c ° w 


E.5.4  CONTROLLABILITY 

The  initial  open-loop  airplane  model  contains  a selection  of  several  possible  control 
surfaces  that  may  be  suitable  for  the  control  task.  One  or  more  of  these  must  be  selected 
for  the  final  design.  Two  criteria  are  used  in  this  selection  process:  mode  controllability 
and  performance  parameter  controllability. 

Consider  an  nth-order  state  model  of  the  airplane  and  the  actuation  system 

x = Ax  + Bu  (E-98) 

y = Cx  (E-99) 
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All  modes  of  this  open-loop  system  are  controllable  by  the  control  vector,  u,  if  and  only  if 
the  following  controllability  matrix 


X,  = (B,  AB,  ...  A"-^B] 


(E-lOO) 


has  rank  n.  In  practice,  satisfying  this  criterion  is  neither  a necessary  condition  nor  a 
sufficient  condition  with  regard  to  adequacy  of  the  control  u to  perform  the  control  task. 
However,  the  relative  controllability  of  a given  mode  by  the  various  elements  of  the 
control  vector  u can  be  obtained  by  transforming  equation  (E-98)  into  block  diagonal  form 
(see  sec  E.2.0)  and  by  appropriate  scaling  of  the  control  vector.  In  practice,  the  elements 
of  u are  bounded  in  magnitude;  therefore. 


|u:|  <u;  (i=  1,  2 . . . m) 

* ‘max 

where  u.  is  the  maximum  absolute  value  of  the  control  u..  Then  the  transformation  is 
max  ^ 

defined 


u = TuUs 


where 


‘max 


• u 


max 


• u 


m 


max 


(E-101) 


and 


u <1  (i  = 1,  2 . . . m) 

I S,  I 

Ug  is  a scaled  control  vector  with  elements  bounded  by  +1. 

Transforming  equation  (E-98)  into  block  diagonal  form  and  substituting  equation  (E-101) 
gives 

z = T'^ATz  + T-^BT^Uj  (E-102) 
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Inspection  of  the  columns  of  the  transformed  control  matrix 


B'  = T-^BTy  (E-103) 

will  show  the  coupling  of  each  control  into  the  various  modes.  To  assess  the  relative 
effectiveness  of  the  controls  in  controlling  a particular  mode,  we  only  have  to  examine 
the  corresponding  row  (or  two  rows,  if  the  mode  is  oscillatory)  of  the  matrix  B'.  The 
column  with  the  largest  absolute  value  will  identify  the  most  effective  control. 

The  concern  is  not  only  the  control  of  specific  modes  but  also  the  control  of  certain 
performance  parameters  such  as  bending  moments,  torsional  moments,  accelerations, 
etc.,  at  various  airplane  stations.  These  are  represented  by  the  state  model  output 
equation  (E-99).  The  relative  controllability  of  these  can  be  assessed  by  computing  the 
steady-state  output  response  correlation  matrices  given  an  appropriately  scaled  white 
noise  input  at  the  individual  control  actuators. 

Consider  the  state  model  with  a single  input  u^ 

X = Ax  + BjUj  (E-104) 

y = Cx  (E-105) 

where  u^  is  a scalar  input  corresponding  to  the  ith  control  and  is  stationary  white  Gaussian 
noise  with  the  properties 

EfUj]  = 0 (E-106) 

E[u:(t)u;(r)l  = U;-  6(t-r)  (E-107) 

* ' * max 

where  u.  > 0 is  the  intensity  of  the  input  noise,  e[~]  is  the  expected  value 
*max 

operator,  and  5(t-r)  is  the  impulse  function.  Using  the  method  described  in  Section 
E.3.0,  the  steady-state  response  correlation  matrix  is  computed  for  the  output  vector  y. 
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1 to  m).  For  a given  performance 

i = 1 to  m (E-108) 

where  m is  the  number  of  controls.  The  most  effective  control,  Uj,  with  respect  to  the 
performance  parameter  yj  is  identified  by  the  largest  variance  v..  | 

Both  mode  controllability  and  performance  parameter  controllability  criteria  described 
previously  only  assess  relative  controllability  and  do  not  guarantee  that  the  selected 
controls  are  adequate  to  perform  the  control  task.  However,  evaluating  the  closed-loop 
control  surface  responses  of  a full-state  feedback  design  will  determine  whether  or  not  a 
given  choice  of  controls  is  adequate  to  perform  the  control  task. 

E.5.5  OBSERVABILITY 

The  initial  open-loop  model  contains  measurement  equations  for  sensors  placed  at  a large 
number  of  possible  locations.  One  or  more  of  these  will  be  selected  for  the  final  design. 
Two  criteria  are  used  for  this  selection;  ' mode  observability  and  performance  parameter 
observability. 

Consider  an  nth-order  state  model  of  an  airplane  that  is  excited  by  random  gust 
velocities,  w , and  expressed  as 

O 

x = Ax  + Fwg  (E-109) 

y = Cx  + Ew„  (E-1 10) 


This  is  repeated  for  all  the  control  inputs  u^  (i  = 
parameter,  y^,  there  will  be  a set  of  m variances 


’JJ 


= E[yjyj] 


All  the  modes  of  this  system  are  observable  from  the  output  vector,  y,  if  and  only  if  the 
following  observability  matrix 


0 = 


C 

CA 

CA"'l 


T 


(E-1 11) 
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has  rank  n.  In  practice,  satisfying  this  criterion  is  neither  a necessary  condition  nor  a 
sufficient  condition  with  regard  to  the  adequacy  of  the  measurements  relative  to  the 
control  task.  However,  the  relative  observability  of  the  rigid  and  flexible  modes  from 
measurements  at  the  various  airplane  stations  can  be  obtained  by  transforming  equation 
(E-109)  into  block  diagonal  form  (see  sec  E.2.0).  Consider  a set  of  like  measurements,  y; 
e.g.,  all  linear  accelerations  or  all  angular  accelerations,  at  the  possible  sensor  locations 
and  expressed  in  terms  of  the  block  diagonal  coordinate,  z,  as 

y = CTz  + EWg  (E-112) 

Inspection  of  the  columns  of  the  transformed  measurement  matrix 

C = CT  (E-113) 

shows  the  relative  observability  of  the  system  modes  from  measurements  at  the  various 
locations.  The  row  containing  the  largest  absolute  value  identifies  the  most  suitable 
location  for  that  particular  type  of  sensor. 


We  are  concerned  not  only  with  observation  of  specific  modes  but  also  with  observation  of 
certain  performance  parameters  such  as  bending  moments,  torsional  moments, 
accelerations,  etc.,  that  are  excited  by  the  random  gust  inputs,  but  which  cannot  be 
measured  directly.  Again,  consider  the  state  model  represented  by  equations  (E-109)  and 
(E-110).  In  this  case,  the  output  vector,  y,  consists  of  various  performance  parameters 
that  are  not  directly  measurable,  as  well  as  a set  of  measurements  at  all  possible  sensor 
locations.  Using  the  method  described  in  Section  E.3.0,  the  steady-state  gust  response 
correlation  matrix  is  computed  for  the  complete  output  vector  y.  For  a given 
performance  parameter,  yj,  there  is  a set  of  p normalized  cross-variances 


E [yj-Vj] 

l/ETPftT 


i = 1 to  p 


(E-114) 


where  p is  the  number  of  sensor  locations.  The  most  suitable  sensor  location  is  identified 
by  the  largest  absolute  value  of  the  normalized  cross-variance  v...  For  a given 
performance  parameter,  y-,  and  input  gust  intensity,  w , the  relative  magnitudes  of  the 

J O 

cross-variances  depend  on  the  correlation  between  the  given  performance  variable  y.  and 
the  measurement  y^  and  the  magnitude  of  the  measurement  variance  v.j.  Thus,  using  the 
magnitude  of  the  normalized  cross-variance  as  a basis  for  sensor  selection  ensures  the 
best  combination  of  sensor-to-performance  criteria  correlation  and  sensor  output  signal- 
to-noise  ratio. 
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E.6.0  CONTROL  LAW  SYNTHESIS 


Control  law  synthesis  consists  of  formulation  of  a state  model  for  synthesis,  modified 
linear  quadratic  regulator  design,  modified  Kalman  state  estimator  design,  and  controller 
simplification. 


E.6.1  FORMULATION  OF  STATE  MODEL  FOR  SYNTHESIS 

Figure  E-17  shows  the  state  model  for  synthesis.  It  comprises  the  airplane  dynamic 
model,  actuation  system  model,  and  the  wind  disturbance  model.  The  airplane  dynamic 
model  is  in  block  diagonal  form  and  may  be  a full-  or  reduced-order  model.  This  study  has 
primarily  been  concerned  with  the  full-order  model  except  for  deletion  of  nonessential 
states.  The  actuation  system  model  contains  the  state  models  of  all  control  surface 
actuators  that  will  be  used  for  the  particular  control  task.  The  linear  regulator  provides 
optimum  closed-loop  response  with  respect  to  release  from  initial  conditions  and  with 
respect  to  random  input  disturbances  that  have  a flat  power  spectrum  over  the  range  of 


• Airplane  dynamic  model  (block  diagonal  form): 


y = CrZr  + DrU  + EpWg 


• Actuation  system  model: 


Xu  = \\  + ^u^'c 


^ 


• Wind  disturbance  model: 


• Combined  state  model  for  synthesis: 
where 


'xw  = A^w  + 

Wg  = 


X = Ax  + BUj,  + TWj.  C - jCp  DpjCjj 
y = Cx  L 


^R 

tm 

0 

0 

X = 

Xu 

.A  = 

0 A^.  0 

. B = 

Bu 

. r = 

0 

’Sv 

1 

o 

0 

Bw 

Figure  E-17.  Formulation  o f State  Mode!  for  Synthesis 
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frequencies  characteristic  of  the  airplane.  The  power  spectrum  of  turbulence  is  not  flat 
over  the  range  of  rigid  and  structural  mode  frequencies  of  a transport  airplane.  Thus,  it  is 
necessary  to  augment  the  synthesis  model  with  a model  of  the  atmosphere  that  has  white 
noise  as  an  input  and  gust  velocities  with  the  desired  power  spectrums  as  an  output.  This 
implies  that  for  a control  law  to  alleviate  loads  due  to  gusts,  it  is  necessary  to  feed  back 
the  gust  states.  These  states  are  observable  from  acceleration  sensors. 

E.6.2  LINEAR  REGULATOR  DESIGN 

Application  of  optimal  control  theory  furnishes  direct  synthesis  of  the  structure  and  gains 
of  an  aircraft  control  system.  Optimal  control  is  based  on  minimizing  a cost  functional, 
subjected  to  the  constraints  of  the  equations  of  motion.  The  most  important  prerequisite 
for  the  design  is  specification  of  the  performance  criterion.  In  some  problems,  the 
construction  of  the  cost  functional  is  obvious  (e.g.,  minimum  time,  minimum  fuel,  etc.), 
but  in  most  cases  it  is  not.  The  quadratic  cost  function,  which  is  an  integral  of 
quadratically  weighted  state  or  output  perturbations  and  the  control  commands,  has  been 
used  in  the  design  of  airplane  controllers.  It  has  won  acceptance  because,  for  linear 
systems,  the  solution  is  easily  computed,  the  control  is  linear,  and  the  method  is  readily 
applicable  to  multivariable  systems. 

To  meet  the  closed-loop  requirements  of  an  active  control  transport,  three  methods  for 
directly  incorporating  specific  design  criteria  in  the  optimal  control  law  synthesis  have 
been  adopted.  The  first  method  is  the  usual  quadratic  cost  penalty  on  specific 
performance  criteria  such  as  deflection,  velocity,  acceleration,  or  load.  The  second 
method  is  implicit  model-following,  which  is  used  to  structure  the  cost  function  so  that 
the  dynamic  response  of  the  closed-loop  system  approaches  that  of  the  model.  This  is  a 
suitable  method  for  incorporating  handling  qualities  criteria  or  other  transient  and  steady- 
state  response  specifications.  The  third  method  is  specification  of  a minimum  degree  of 
stability.  This  will  ensure  that  all  closed-loop  eigenvalues  will  be  placed  to  the  left  of  a 
line  parallel  to  the  imaginary  axis. 

In  the  following,  equations  for  a continous  optimal  system  based  on  an  implicit  model  with 
control  terms  are  derived  using  the  variational  approach.  The  solution  yields  feedforward 
and  feedback  gains.  These  results  are  extended  to  the  case  where  the  cost  function  is 
structured  using  the  implicit  model  technique  for  some  states,  while  a conventional 
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quadratic  cost  formulation  is  used  for  the  remaining  states.  Finally,  a method  is 
delineated  for  specifying  a prescribed  degree  of  stability  for  the  closed-loop  system  via 
the  cost  function. 

The  airplane  and  controls  are  represented  by  an  n-dimensional  time-invariant  vector 
differential  equation 


X = Ax  + Bu 


(E-115) 


The  desired  performance  is  described  by  an  n-dimensional  time-invariant  model 


x~  = A~x~  + 
m mm  mm 

The  problem  is  to  find  the  p-dimensional  control 


(E-116) 


u = Gx  + MUj^ 


so  as  to  minimize  the  cost  function 


(E-117) 


J = Vif  [(x-Xj^)^Q(x-Xj^)  + u'^Ru  ] dt  (E-1I8) 

-'o 

where  matrices  Q(n  x n)  and  R(p  x p)  are  constant,  symmetric,  and  positive  semidefinite 
and  positive  definite,  respectively.  Substituting  equations  (E-115)  and  (E-116)  into 
equation  (E-118)  and  letting  x^  = x,  the  cost  function  becomes 


J = 'A/  [xT^(A-A^)TQ(A-An,)x  + 2x^  (A-Aj„)^Q(Bu-BniUn,) 
•'0 

+ (Bu-Bj„Uj^)'^Q(Bu-Bj„u,n)  u’^Ru]  dt 


(E-119) 


The  Hamiltonian  is  formed 

H = */2[xT'(A-Aj„)TQ(A-Ajn)x  + 2xT(A-Aj„)TqBu 

- 2x’T  (A-An^)’^QBn^u^  + uTbTqBu  (E-120) 

- 2uVqBj^Uj„  + UjjBn^QBmUjTi  p'^CAx+Bu) 
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where  p is  an  n-dimensional  vector  of  Lagrange  multipliers  (or  costate  vector). 


On  the  optimal  trajectory 


control  equation 

(E-121) 

state  equation 

(E-122) 

costate  equation 

(E-123) 

Using  equations  (E-120)  and  (E-121) 

u = -{B’rQB+R)'lB’^Q(A-Ajn)x-  (b’^QB+R)'*B^P  + (b'*'qB+R)‘^b’^QBj„u^  (E-124) 

from  equations  (E-120),  (E-122),  and  (E-124) 


X = (A-B(B^QB+R)’*  B^Q(A-Aj„))x  - B(B^QB+R)'^b’^P  + B(b’^QB+R)'^ 


from  equations  (E-120),  (E-123),  and  (E-124) 

p = (A-Ani)'^(QB(B'rQB+R)*lB'^Q-Q)(A-An,)x  + ((A-An^)'rQB(B^QB+R)*^B'^-A'^)p 

+ (A-An^)TQ(I.B  (BTQB+R)-lBTQ)Bn,u^ 

The  state  and  costate  equations  become 


with  boundary  conditions 


Ptf 


= 0 


(E-125) 


(E-126) 

(E-127) 


where  t^  is  the  initial  time  and  tj  is  the  final  time. 
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Also 


A = A - B (B’^QB+R)"!  B^Q  (A-Aj^) 

S = B (B’f'oB+Rr^B’^ 

Q = (A-A,„)T(Q-OB(B'rQB+Rr’BT'Q)(A-An,) 
B = BCBT’QB+Rr’B'^'QBm 
C = (A-A^)T(Q-QB(B'rQB+RrlBTQ)Bj„ 

The  solution  for  p is  of  the  form 


p = Kx  + N (E-I28) 

Differentiating  equation  (E-128) 

p = Kx  + Kx+N  (E-129) 

Substituting  from  equations  (E-125)  and  (E-128)  Into  equation  (E-129) 

p = (K  + KA  - KSK)x  - KSN  + N + KBUj^^  (E-130) 

and  from  equations  (E-125)  and  (E-128) 

p = -(Q  + aT'kIx  - A^'n  + Cu^i  (E- 1 3 1 ) 

Subtracting  equation  (E-131)  from  (E-130) 

(K  + KA-KSK+  a’^K  + Q)x  + N + (A^  - KS)N  + (KB  -C)Uni  = 0 (E-132) 


Equation  (E-132)  must  be  satisfied  for  any  arbitrary  x and  u^^.  Thus,  these  two  relations 
must  be  satisfied 

K + KA-KSK  + aTk+Q  = 0 (E-133) 

N + (aT  - KS)N  + (KB  - C)u,„  = 0 (E-134) 
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with  boundary  conditions  from  equations  (E-127)  and  (E-128) 

= 0 
Ntf.  = 0 

Equations  (E-133)  and  (E-134)  and  the  associated  boundary  conditions  represent  a linear 
tracking  problem.  The  matrix  Riccati  equation  (E-133)  can  be  solved  independently  of 
equation  (E-13^),  and  the  solution  is  used  to  compute  the  optimal  feedback.  This  feedback 
is  the  same  as  that  of  the  equivalent  linear  regulator  problem.  For  an  infinite  time 
controller,  only  the  steady-state  solution  is  of  interest.  There  are  several  methods  for 
obtaining  the  solution  to  the  matrix  Riccati  equation;  however,  the  modified  eigenvector 
technique  used  in  the  EASY  5 program  appears  to  be  the  most  efficient  method. 

Having  obtained  the  solution  to  equation  (E-133),  equation  (E-134)  can  be  solved.  Let 
be  the  steady-state  solution  to  the  matrix  Riccati  equation;  then  from  equations  (E-123), 
(E-128),  and  (E-134) 


“x“ 

"(A  -SKss)  -S 

“x” 

B " 

= 

+ 

N 

0 -(A-Skss)T 

N 

JC  - K^sB) 

(E-135) 


where 


= X 


0 


= 0 


The  matrix  (A  - SK^^)  is  the  closed-loop  system  matrix.  If  all  the  unstable  modes  of  the 
unaugmented  plant  are  controllable,  the  closed-loop  system  eigenvalues  all  have  negative 
real  parts.  The  matrix  (SK^^  - A)"^  associated  with  the  feedforward  term  N has  an 
eigenvalue  system  that  is  the  mirror  image  of  that  of  the  closed-loop  system;  i.e.,  all  real 
parts  are  positive.  It  should  be  noted  that  both  and  S are  symmetric  matrices.  The 
solution  for  N is  obtained  by  integrating  backward  in  time,  starting  with  the  boundary 
condition  at  time  t^  (final  time).  Thus,  to  obtain  the  feedforward  control  at  some  point  in 
time,  it  is  necessary  to  know  the  control  u^  for  all  time.  To  develop  a practical  solution, 
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it  is  necessary  to  assume  that  is  constant.  The  practical  interpretation  of  this 
assumption  is  that  the  changes  in  u occur  slowly  with  respect  to  the  closed-loop  system 
dynamics;  i.e.,  N will  be  small.  This  agrees  with  the  way  steady-state  control  responses 
(e.g.,  elevator  per  g,  steady-state  roll  rate,  etc.)  are  specified  in  handling  qualities 
criteria. 

If  u^  is  assumed  constant,  then  for  an  infinite-time  controller,  the  steady-state  value  for 
N is 

Nss  = (a’'  - KssS)->(C  - (E-136) 


which  reduces  equation  (E-135)  to 

X = (A  - SKgs)x  +[b  - S(a'T-  Ks5S)'kc  - (E-137) 


or 


X = (A  + BG)x  + BMUjp 


(E-138) 


Figure  E-18  is  a schematic  of  the  closed-loop  system  described  by  equations  (E-137)  or 
(E-138).  The  feedback  and  feedforward  gain  matrices  G and  M are  expressed  as  follows 


G = -(BTQB+R)-lBTQ(A-An^)  - (B^QB+RI'^B^Kss  (E-139) 

M = (B'rQB+R)‘^B'^QBj^  + (B'rQB+R)-lB'T(A 'T-K5sS)'kK5sB-C)  (E-140) 

Equations  (E-124),  (E-139),  and  (E-140)  show  that  both  the  feedback  and  feedforward  gains 
are  made  up  of  two  parts.  The  first  is  synthesized  directly  from  the  cross  product  of 
state  and  control  in  the  cost  function,  prior  to  the  solution  of  the  state  and  costate 
equations  (E-125).  The  second  part  results  from  the  solution  of  the  matrix  Riccati 
equation  (E-133)  and  the  forward  control  equation  (E-134),  respectively. 

The  optimal  feedback  matrix  G is  independent  of  the  model  control  matrix  and  is  also 
identical  to  that  of  the  equivalent  linear  regulator  problem  (i.e.,  with  = 0).  The 
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Disturbances 


Figure  E- 18.  Implicit  Model-Following 


optimal  feedforward  matrix  M depends  on  the  model,  the  unaugmented  system,  and  the 
feedback  matrix  G. 

For  a solution  to  exist  to  the  optimal  control  problem,  a necessary  condition  is  that  the 
matrix  (B  QB  + R)  is  nonsingular.  This  is  ensured  by  the  constraints  placed  on  the 
matrices  Q and  R.  However,  if  Q is  nonsingular  and  B has  full  rank,  B^'^QB  is  nonsingular 
and  R can  be  equal  to  zero.  Furthermore,  if  B is  square  matrix,  then  perfect  model- 
following is  achieved.  If  R = 0 and  (B"^QBr^  = B'^Q'^(B^)*^  exists,  then 

A = A - (A-A,^)  = Am 
S = Q“^ 

Q = 0 

I = 

C = 0 


Equation  (E-125)  is  modified  to 


rl 


-Q 


-A^m 


'm 


•‘m 


(E-I41) 
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Because  p = 0,  then  p = 0;  and  from  equation  (E-128),  K = 0 and  N = 0 for  all  time. 

^f 

The  closed-loop  system  becomes 

X = Aj^x  + B^Uj^  (E-142) 

To  achieve  this,  the  feedback  and  feedforward  matrices  are  respectively 

G = -B"*  (A-A„^)  (E-143) 

and 

M=  B'*B„,  (E-144) 

These  results  could  also  be  derived  simply  by  inspection  of  equations  (E-115),  (E-116),  and 
(E-117). 

It  may  not  be  desirable  to  use  the  implicit  model-following  technique  to  structure  the  cost 
function  for  all  states.  Typically,  for  a flexible  aircraft,  implicit  model-following  could 
be  used  for  the  rigid-body  modes  and  a conventional  quadratic  cost  formulation  used  for 
the  flexible  structural  modes.  This  problem  is  solved  simply  by  extending  the  results 
derived  in  the  preceding  section. 

Again,  the  flexible  aircraft  and  associated  controls  are  represented  by  the  time-invariant 
vector  differential  equation 

X = Ax  + Bu  (E-145) 


The  desired  rigid  mode  performance  is  described  by  a time-invariant  model 

A and  A are  n x n constant  matrices, 
m 

B is  an  n x p constant  matrix. 


(E-146) 
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B is  an  n X j constant  matrix, 
m ’ 

Suppose  implicit  model-following  is  used  for  i states  using  j controls.  Partition  the 
matrices  as  follows: 


A = 


and 


B = 


Let 


A 


m 


and 


B 
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Define 


Am, 2 = A, 2 
Amj,  = A21 
^22  " ^22 


then  from  equation  (E-1^7) 
^11  “ 


A-  Ajj^ 


1 X 1 


The  problem  is  to  find  the  p-dimensional  control 


u = Gx  + Mu 


m 


so  as  to  minimize  the  cost  function 

J = V2  f [(x-Xjjj)^Qj(x  - Xj^)  + x^Q2X  + u^Ru]  dt 
o 


(E-147) 


(E-148) 


(E-149) 


The  first  term  represents  the  cost  function  for  the  rigid-body  states,  the  second  term 
represents  additional  quadratic  cost,  and  the  third  term  represents  the  cost  function  for 
the  total  control  vector.  The  cost  weight  matrix,  Q2,  is  obtained  from  the  cost  weight 
matrix,  Q'2  , on  a set  of  output  parameters,  y,  by  letting 

y = Cx 


and 


xTQjx 


= xTcTq’jCx 


then 

Q2  = cTq'2C 
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Substituting  equations  (E-K5)  and  (E-1^6)  into  equation  (E-149)  and  letting 
cost  function  becomes 

J = nxT(A-Aj„)TQj  (A-A„j)x  + 2xT  (A-Ajn)TQj 
o 

+ (Bu-BjnUjn)^Q2(Bu-BjjjUj„)  + x'^Q2X  + u’^Ru]  dt 

Qj  (n  X n)  and  Q2  (n  x n)  are  positive,  semidefinite,  and  symmetric;  and  R is 
definite,  and  symmetric. 

The  Hamiltonian  is  formed 

H = 1/^  |xT  [(A-Anj)TQj  (A-A^j)  + Q2]  x 

+ u'T(B’^Q2B+R)  u + 2x'^(A-Aj„)TQiBu 
- (A-A^)TQiB^u^  - 2uTbTQjB^u^ 

+ Bm^m}  + (Ax  + Bu) 

where  p is  an  n-dimensional  vector  of  Lagrange  multipliers  (or  costate  vector). 

On  the  optimal  trajectory 

control  equation 
state  equation 

costate  equation 


= X,  the 

(E-150) 

positive, 

(E-151) 


(E-121) 

(E-122) 

(E-123) 
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From  equations  (E-151)  and  (E-121) 

u =-  (bTQjB+R)-1bTQj(A-A^)x  + (B'TQjB+Rr^BTQjBn^u^ 
-(b'^QiB+r)’*b’^p 

From  equations  (E-151),  (E-122),  and  (E-152) 

X = [A*B(b'^QiB+R)*’b'^Qj(A-Aj„)]  x-B(B'^QjB+R)-^B'^p 

+ B(BTQiB+R)-^BTQ,Bj„Uni 
From  equations  (E-151),  (E-123),  and  (E-152) 

P = -[Q2+(A-An,)'T(Ql-Q,B(BTQjB+R)-^BTQj)(A-An,)]  x 

- (A^-  (A-An^)TQ,B(BT’QlB+R)*^BT]  p 

- (A-A^)T’[Q,B(B'TQ,B+R)-lB'rQj-Q,  ] B„,Un, 

The  state  and  costate  equations  become 


X 

"Al 

-S|  ■ 

X 

= 

+ 

• 

_p_ 

:Qi 

_P_ 

_Cl_ 

with  boundary  conditions 

Xj  — Xq 
Iq 

Ptj-  = 0 

where  t^  is  initial  time  and  t^  is  final  time. 

Also 

Aj  = A-B(B'^QiB+R)'^b'^Q,(A-Aj„) 

"Sj  = B(b”TQiB+R)*^B^ 

Qj  = Q2+(A-An,)T(Qi-QiB(BTQjB+R)-^BTQj)(A-An,) 

Bj  = B(BTQ,B+R)-lBTQjBni 

C,  = (A-An,)T[Qi-QjB(B'TQiB+R)-lBTQ,]Bn, 


(E-152) 


(E-153) 


E-59 


Equation  (E-153)  is  of  the  same  form  as  equation  (E-125).  Thus,  the  method  of  solution 
derived  previously  can  be  applied  with  appropriate  substitutions  for  A,  S,  Q,  B,  and  C. 

The  feedback  and  feedforward  gain  matrices  G and  M are  expressed  respectively  as 

G = -(B'''QiB+Rr^B'^Q,(A-Ani)-(B’^QlB+R)‘*B'rK'55  (E-154) 

M = (B''^Q,B+R)->B'rQlBn,  + (bTq,B+R)*‘b'^(A]T^K'ss?i)*'(K'ssBi-Ci)  (E-155) 

where  is  the  steady-state  solution  to  the  matrix  Riccati  equation 

K'  + KAj  - K'Si  K'  + Aj^K'  + Qj  = 0 

It  can  be  shown  by  substitution  of  the  partitioned  matrices  A,  A^,  B,  B^,  Q^,  Q^,  and  R 
into  equations  (E-154)  and  (E-155)  that  the  term  (b”^Q^B)  adds  cost  penalty  to  the 
controls,  and  if 

G = G'  + G" 

where 

G'  = -(BTq,B+R)-'bTO](A-A,„) 

G"  = -(BT'QiB+Rr'B’^R's^ 

then 


j X i 

' 0 

1 j X (n-i) 

1 

j X i 

1 

1 

1 

1 

j X (n-i ) 

Jp-j)x  i 

1 

1 0 

, fp-j)x(n-i) 

G”:i 
_(p*j)x  i 

■*r  * 
1 
1 
1 

C”22 

(p-j)x(n-i^ 

The  first  term  in  equation  (E-154)  provides  feedback  from  the  first  i states  (i.e.,  only  the 
rigid-body  states).  Thus,  this  term  is  associated  with  the  implicit  model-following. 
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The  feedforward  matrix  M has  the  following  structure 


M 


M21 
(P-j)x  j 


Thus,  only  the  j controls  associated  with  the  implicit  model-following  are  fed  forward. 


The  following  describes  a method  for  specifying  a prescribed  degree  of  stability  for  the 
closed-loop  system  via  the  cost  function.  It  can  be  shown  that  for  time-invariant  systems, 
with  performance  indices  of  the  form 

J = VzJ^  e^“^(x^Qx  + u^Ru)  dt 
o 

where  a is  a positive  scalar,  Q is  constant  positive  semidefinite,  and  R is  constant  positive 
definite  matrices,  the  optimal  synthesis  leads  to  a linear  and  constant  control  law.  Also, 
the  closed-loop  system  is  not  merely  asymptotically  stable,  but  any  nonzero  initial  states 
will  decay  faster  than  e~  This  is  equivalent  to  having  eigenvalues  with  real  parts  less 
than  - a. 

Multiplying  the  integrand  of  equation  (E-150)  by  e^  gives 


J = 


x^(A-Aj^)^Q](A-Am)x  + 2x^(A-A^)^Q|  (Bu-Bj^u^) 


+ (Bu-B,^Uj^)^Qj(Bu-Bj^Uj^)  + x^Q2X+  u^Ru 


(E-156) 


dt 


Transformations  are  introduced  that  convert  this  problem  to  one  equivalent  to  the  type 
solved  previously.  Accordingly,  we  define 


A 

X 


e“^x 


A 

u 


e“^u 


m 


e “^x 


m 


m 


m 


(E-157a) 

(E-157b) 

(E-158a) 

(E-I58b) 
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Then 


X = — (e*^^x)  = o:e“^x  + x 


(E-159) 


Substituting  equation  (E-145)  into  equation  (E-160) 


X = (A  + al)  X + Bu 


(E-160) 


where  I is  the  identity  matrix,  and  the  initial  condition  is 


X*  = e '^x,  where  x.  = x» 
•■o  ^o  ^o 


and  similarly 


= <An,+aI)Xn,  + 


(E-161) 


Equation  (E-156)  can  be  rewritten  as  follows: 


00 

J = [x^  (A-A,„)TQj  (A-A„,)x  -t-  (A-A,„)TQj  (B(i-Bn^Uj. 

o 

+ (Bu-B^Uj^)'fQ,  (Bu-B„,Un^)  -h  x^02X  + u^Ru]  dt 


(E-162) 


Suppose  u*  is  optimal  control  for  the  problem  described  by  equations  (E-145)  and  (E-156), 
and  X is  the  value  of  the  state,  given  the  initial  value  x^  = x . Then  the  optimal  control 

for  the  problem  described  by  equations  {E-151)  and  (E-162)  is  u*  = e “^u*,  and  the  state  is 
given  by  X = e °^^x,  provided  x*  = e*^^°x  . The  minimum  performance  index  is  the  same 

for  each  problem  ^equation  (E-156)  is  equivalent  to  equation  (E-162)J . 

If  the  optimal  control  for  the  second  problem  is 


u*  = K (x,t) 


(E-163) 


then  the  optimal  control  for  the  first  problem  is 


ii*  = e'^^u*  = e'“^K(e“^\.  t) 


(E-164) 
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Thus,  the  optimal  control  can  be  derived  for  the  problem  described  by  equations  (E-1^^5) 
and  (E-156)  from  the  optimal  control  for  the  problem  described  by  equations  (E-161)  and 
(E-162). 


From  equation  (E-153),  making  the  appropriate  substitutions, 
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«y 
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A 

Cl_ 

with  boundary  conditions 

A _ atn 
■'‘to  - " ^o 
\ = 0 

p is  a vector  of  Lagrange  multipliers  (or  costate  vector). 
Also 

A,  = A + aI-B(B'rQlB+R)-^B’^Ql(A-A„,) 

Sj  = B(B'^Q]B+R)~'b’^ 

Q,  = Q2+(A-A„^)T(Q,-0,B(B'rQjB+R)-lBT'0,KA-An^) 

Bi  = B(BTQjB+R)-’BT'QlBni 

C,  = (A-A,„)T[Q,-OjB(bTQjB+R)-’bTQj]b„t 


(E-165) 


By  inspection  of  the  terms  in  equations  (E-153)  and  (E-165),  it  can  be  seen  that 


Aj  = Aj  + 0:1 

A 


Si  = Si 

A _ 

Ol  = Qi 

A — 
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The  solution  to  the  optimal  control  problem  described  by  equation  (E-165)  is 


^ AA  AA 

u*  = Gx  + MUj^ 


(E-166) 


Substituting  equation  (E-166)  into  equation  (E-164),  the  optimal  control  can  be  obtained 
for  the  problem  described  by  equations  (E-145)  and  (E-156) 

u*  = e*^Ge“^x  + Uj^ 


which  reduces  to 

A A 

11*  = Gx  + MUj^ 


where 


and 

M = (B’^QiB+Rl'^B’^QlBn,  + (bT'QjB+RI'^b'^ 

A 'T  ^ 1 . A A 


is  the  steady-state  solution  to  the  matrix  Riccati  equation 


• ^ 

K’  + K'(Ai  +al)- K’SjK'  + (A|  + al)K'  + Qj  = 0 


(E-167) 


(E-168) 


(E-I69) 


To  demonstrate  the  degree  of  stability  achieved,  rearrange  equation  (E-157)  to 


X = 


e“^^x 


(E-170) 


Because  the  optimal  design  guarantees  that  the  closed-loop  system  is  asymptotically 
stable,  X approaches  zero  as  time  approaches  infinity.  Consequently,  x approaches  zero 
faster  than  e ~ 
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In  summary,  if 


J = Vif^  L(x,  u)dt  (E-17I) 

to 

is  a quadratic  cost  function,  then  the  solution  to  the  optimal  control  problem 

J = Vz  J°°  L(x,u)dt  (E-172) 

to 

X = Ax  + Bu  (E-173) 


is  equivalent  to  the  solution  to  the  optimal  control  problem. 


J = 


OO 

V2  J L(x.u)dt 


X = (A  + al)x  + Bu 


(E-174) 


where  (A  + al)  has  eigenvalues  located  at  a distance  a to  the  right  of  the  eigenvalues  of  A 
with  the  imaginary  parts  remaining  the  same. 


Apart  from  implicit  model-following,  another  approach  for  incorporating  command 
response  criteria  into  the  linear  regulator  design  is  explicit  model-following.  This  method 
was  found  to  be  very  useful  in  the  synthesis  of  control  laws  that  produced  good  pitch-rate 
and  normal  load  factor  responses.  The  method  consists  of  placing  an  ideal  model  of  the 
airplane  to  be  controlled  in  the  forward  path  of  the  control  loop  as  shown  in  Figure  E-19. 
The  gain  matrices  G and  are  synthesized  based  on  the  quadratic  cost  function 

J = Vi  J (e-i7S) 

o 


where 


ym  “ 


is  the  ideal  model  response  to  the  input  u^  and 


y = CgX 


(E-176) 


(E-177) 
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Disturbances 


Figure  £- 19.  System  Using  Explicit  Model-Following 


is  the  actual  airplane  response.  The  ideal  model  is  described  by  the  state  model 

Xm(t)  = + Bn,u„,(t) 

The  control  law  synthesis  is  performed  using  the  augmented  open-loop  state  model 
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_Xj^(t)_ 

(E-178) 


(E-179) 


y * ym  [^s  I 

The  control  u^(t)  simply  becomes 

u^,(t)  = Gx(t)  + G„,Xj^(t) 


x(t) 

Xjn(t) 


(E-180) 


(E-181) 
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The  state  vectors  x(t)  and  x^(t)  need  not  be  of  the  same  dimension.  In  particular  for  the 
synthesis  of  the  pitch  augmentation  control  laws,  the  vector  x^(t)  consisted  of 

= 

where  u^^  is  incremental  forward  velocity,  is  incremental  angle  of  attack,  is  pitch 
rate,  and  0^  is  incremental  pitch  angle.  The  vector  x(t)  comprised,  in  addition  to  states 
corresponding  to  the  above,  both  actuator  states  and  wind  states. 

E.6.3  MODIFIED  KALMAN  FILTER  DESIGN 

After  the  control  problem  has  been  solved  using  the  modified  linear  quadratic  regulator 
design  outlined  previously,  a state  estimator  must  be  constructed.  Stochastic  optimal 
control  theory  has  been  applied  widely  to  linear  time-invariant  systems  having  quadratic 
cost  criteria  and  additive  white  Gaussian  noise.  However,  the  usefulness  of  the  theory  has 
been  limited  by  the  sensitivity  of  the  closed-loop  performance  to  parameter  variations. 
Modeling  of  a process  is  never  exact,  and  because  design  of  a system  is  based  on  an 
approximate  model,  the  design  must  be  insensitive  to  modeling  uncertainties,  in  particular 
with  respect  to  the  stabiiity  of  the  system.  Optimal  control  with  full-state  feedback 
offers  good  stability  margins,  but  when  a Kalman  filter  is  inserted  into  the  loop  to 
estimate  state  variables,  the  stability  margins  shrink,  sometimes  drastically.  To  alleviate 
this  problem,  a method  has  been  implemented  that  increases  the  robustness  of  the  closed- 
loop  system  with  respect  to  parameter  variations  at  the  expense  of  filter  performance 
when  parameters  are  at  their  nominal  values.  The  following  outlines  the  problem  and  a 
method  for  designing  robust  control  systems  incorporating  Kalman  filters. 

Not  only  is  the  system  with  full-state  feedback  optimal  with  respect  to  the  cost  function, 
but  the  system  also  has  the  property  of  being  robust  with  respect  to  parameter  variations 
in  the  control  channels,  as  shown  in  Figure  E-20.  The  closed-loop  system  is  robust  with 
respect  to  parameter  variations  in  each  of  the  control  channels  in  the  sense  that  if 

'/2  < kj  < oo  i = 1, . . m 

or  if  -6Odeg<0j  < 60  deg  i=  1,...,  m 


u 


m 

6rr. 

m 


(E-182) 
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Plant 


Figure  E-20.  Parameter  Variations  in  the  Controi  Loops 

the  system  will  remain  stable;  i.e.,  the  system  has  gain  margin  of  at  least  -6  dB  to  + « 
simultaneously  in  all  control  channels  and  has  phase  margin  of  at  least  +60  deg 
simultaneously  in  all  control  channels  (ref  E-5). 

While  these  results  are  quite  strong,  they  are  based  on  the  restrictive  assumption  that  all 
of  the  state  variables  are  available  and  thus  can  be  multiplied  by  the  optimal  gain  matrix 
to  produce  an  optimal  control.  In  most  practical  situations,  the  full-state  vector  is  not 
available  for  feedback  and  instead  a Kalman  filter  is  inserted  in  the  control  loop  to 
estimate  the  values  of  the  states  based  on  the  available  measurements. 

A control  loop  incorporating  a steady -state  Kalman  filter  is  shown  in  Figure  E-21.  The 
filter  accepts  as  inputs  the  sensor  outputs,  y,  and  produces  an  optimal  estimate,  x,  of  the 
state  vector,  x.  This  estimate,  x,  is  then  multiplied  by  the  optimal  gain  matrix,  G,  to 
produce  the  optimal  control. 
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Figure  E-21.  Control  System  With  Kalman  Filter 


The  Kalman  filter  is  essentially  a mathematical  replica  of  the  plant,  except  that  the 
sensor  outputs,  y,  are  compared  with  the  estimated  outputs,  y,  to  produce  an  error  signal 
that  drives  the  filter.  The  equations  of  the  filter  are 


X = Ax  + Bu  + S(y  - y) 

A ^ 

y = Cx 


(E-183) 
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The  Kalman  filter  gain  matrix,  S,  is  calculated  as  follows.  The  plant  is  assumed  to  be 
disturbed  by  random  noise,  d.  This  is  referred  to  as  "process  noise"  and  is  modeled  as 
stationary  white  Gaussian  noise.  It  may  be  used  to  represent  such  disturbances  as  wind 
gusts  and  may  also  be  used  as  a measure  of  modeling  uncertainty.  The  noise  has  the 
properties 


E [d]  =0 

E [d(t)  dV)]  = 6(t  - r) 


(E-184) 


where  > 0 is  the  intensity  matrix  of  the  noise,  and  E j is  the  expected  value 

operator.  There  is  noise  also  associated  with  the  sensors.  This  "measurement  noise,"  v,  is 
also  assumed  to  be  stationary  white  Gaussian  noise  with  the  parameters 


Elvl  =0 

E [v(t)v^(T)]  = Cy5(t-r) 


(E-185) 


T 

where  > 0 is  the  intensity  matrix  of  the  noise.  The  process  noise  and 

measurement  noise  are  passed  through  distribution  matrices  P and  F,  respectively,  so 

T T 

that  the  intensity  matrices  seen  at  the  plant  are  FC^  P and  FC^F  . 

For  the  purpose  of  computing  the  filter  gain  matrix,  the  plant  is  assumed  to  have  the  form 

X = Ax  + Bu  + Pd 
y = Cx  + Fv 

The  filter  gain  matrix  is  then  given  by 

S = KC^fFCyF’^r’ 

where  K satisfies  the  algebraic  Riccati  equation 

AK  + KA^"-  Kc’^(FCVfT)-’  CK  + PC^ipT  = 0 (E-188) 


(E-186) 


(E-187) 
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J 

It  is  assumed  that  F has  maximum  possible  rank  so  that  FC^F  is  nonsingular.  The  pair 
(A,  r)  is  assumed  to  be  controllable,  and  the  pair  (A,C)  is  assumed  to  be  observable  to 
guarantee  that  there  is  a unique,  symmetric,  positive  definite  solution,  K,  for  the  Riccati 
equation  (E-188). 

While  the  control  system  employing  the  Kalman  filter  is  optimal  with  respect  to  the  cost 
function  and  the  noise  intensities  d and  v,  the  closed-loop  system  does  not  have  the 
robustness  properties  associated  with  the  full-state  feedback  controller.  In  fact,  in  some 
cases,  the  stability  margins  can  become  vanishingly  small  (ref  E-6).  This  can  be  explained 
by  the  fact  that  if  the  loop  is  broken  at  point  X in  Figure  E-21,  the  transfer  function 
around  the  loop  is  not  the  same  as  it  is  for  full-state  feedback  unless  it  happens  that 

S[I  + C(sl  - A)'^S]*’  = B[C(sI  - (E-189) 

So  unless  this  identity  holds,  perturbations  appearing  at  point  X will  have  a different 
effect  when  the  filter  is  in  the  loop  than  in  the  case  of  full-state  feedback  (ref  E-7). 

However,  equation  (E-189)  can  be  satisfied  if  S = qBW  and  q-*-w  and  W is  a nonsingular 

T T 2 T 

matrix.  It  can  be  shown  that  if  P is  replaced  by  PC^  P + q BVB  in  equation 

(E-188)  where  V = > 0 is  arbitrary,  and  if  the  open-loop  system  has  no  right  half -plane 

transmission  zeros,  then 

S ->  qBV’/‘(R'/")-l 

y,  1/2 

as  q -►  00 , where  V is  some  square  root  of  V,  and  R is  some  square  root  of  R.  S then 

approaches  qBW  as  q -+•  00  where  W = V^^(R'^^)'^.  Then  in  the  limit,  equation  (E-189)  is 

satisfied  and  the  system  employing  the  Kalman  filter  has  the  robustness  properties  of  the 
full-state  feedback  system  as  q -►  «. 

If  we  let  Cj  ^ q^V,  then  PC^  P^  will  have  been  replaced  by  PC^  P^  + BC^B^  in  the 
Riccati  equation.  can  be  thought  of  as  being  the  intensity  matrix  of  a zero-mean 
stationary  white  Gaussian  noise  vector,  d,  appearing  at  the  input  to  the  plant  as  shown  in 
Figure  E-22.  The  plant  equations  then  become 
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Figure  E-22.  Addition  of  Input  Noise  to  Model 


X = Ax  + Bu  + Pci  + Bd 
y = Cx  + Fv 


(E-190) 


The  process  noise  has  been  augmented  by  a fictitious  input  noise,  d,  with  distribution 
matrix,  B.  The  Riccati  equation  then  becomes 

AK  + Ka”^-  CK  + PC^P^  + BCjB^  = 0 (E-191) 


E-72 


As  the  magnitude  of  the  diagonal  elements  of  is  increased  (i.e.,  as  the  fictitious  input 
noise  becomes  stronger),  the  robustness  properties  of  the  controller  approach  those  of  the 
system  with  full-state  feedback.  Adding  fictitious  noise  at  the  input  to  the  system  tells 
the  mathematics  that  uncertainties  should  be  expected  at  that  point,  and  the  calculation 
of  the  filter  takes  this  uncertainty  into  account  by  increasing  robustness  with  respect  to 
uncertainties  at  that  point.  But  increasing  the  intensity  of  either  the  input  noise  or  the 
process  noise  has  the  effect  of  telling  the  mathematics,  via  the  Riccati  equation  (E-191), 
that  the  model  is  not  accurate  or  that  the  disturbances  to  the  model  are  great  enough  that 
the  system  should  place  more  emphasis  on  the  actual  sensor  measurements  than  on  model 
accuracy. 

Larger  values  of  or  in  equation  (E-191)  have  the  effect  of  making  the  elements  of 
K larger  in  the  solution  of  equation  (E-191).  The  result  is  that  the  elements  of  the  filter 
gain  matrix,  S,  become  large  in  equation  (E-187),  increasing  the  gain  and  bandwidth  of  the 
filter  and  allowing  more  sensor  noise  to  pass  through  the  filter.  Because  K has  the 
property  (ref  E-8) 


K = lim  E ([x(t)  - x(t)]  [x(t)-  x(t)]^) 

t ->  oo 

it  follows  that  as  K is  increased,  the  accuracy  of  the  filter  is  reduced.  The  design 
problem  therefore  involves  a tradeoff  between  filtering  accuracy  (when  the  parameters 
are  at  their  assumed  nominal  values)  and  robustness  of  the  closed-loop  system  with 
respect  to  parameter  variations  shown  in  Figure  E-20. 

E.6.4  CONTROLLER  SIMPLIFICATION 

The  Kalman  filter  will  have  the  same  dynamic  order  as  that  of  the  open-loop  model  used 
for  the  synthesis.  For  a flexible  airplane  model  that  contains  a large  number  of  structural 
modes,  the  high  order  of  the  filter  imposes  an  excessive  and  unnecessary  computational 
burden  on  flight  computers.  A preliminary  approach  to  the  design  of  a low-order 
suboptimal  filter  has  been  established  during  this  study.  It  will  be  outlined  here. 

The  first  task  is  to  establish  the  minimum  bandwidth  of  the  controller.  The  actuation 
bandwidth  is  set  by  the  highest  frequency  at  which  we  wish  to  control.  In  the  case  of 
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FMC,  it  is  set  by  the  highest  frequency  flutter  mode,  and,  in  the  case  of  GLA,  it  is  set  by 
the  highest  frequency  mode  that  contributes  significantly  to  the  gust  loads.  The  latter  is 
easily  determined  from  cumulative  power  density  plots  of  the  appropriate  performance 
parameters  such  as  bending  moments,  torsional  moments,  accelerations,  etc.,  at  various 
airplane  stations.  A third  factor  that  must  be  considered  is  the  increasing  uncertainty  in 
the  dynamic  model  with  increasing  frequency.  The  controller  bandwidth  must  be  limited 
such  that  at  higher  frequencies,  the  closed-loop  system  has  sufficiently  large  stability 
margins.  The  modal  residualization  technique  described  in  Subsection  EA.2  can  be  used  to 
eliminate  filter  modes  that  are  outside  the  required  actuation  bandwidth.  Because  the 
Kalman  filter  only  has  first-order  rolloff  characteristics  at  high  frequencies,  it  may  be 
necessary  to  insert  an  additional  filter  in  the  control  loop  to  ensure  the  necessary 
attenuation  at  high  frequencies. 

The  reduced  filter  may  still  be  too  complex  for  practical  implementation  on  flight 
computers.  Further  reduction  may  still  be  possible  without  any  significant  loss  in  closed- 
loop  performance.  Again,  the  modal  residualization  technique  can  be  used  to  eliminate 
filter  modes  that  are  within  the  actuation  bandwidth  but  that  are  associated  with  weakly 
unobservable  or  weakly  controllable  airplane  modes  or  with  airplane  modes  that  are  not 
observable  from  the  cost  function. 

In  the  previous  discussion,  it  was  assumed  that  the  Kalman  filter  was  synthesized  using  a 
full-order  airplane  model  and  that  the  lower  order  suboptimal  filter  was  obtained  by  the 
reduction  of  this  full-order  filter.  However,  another  approach  would  be  to  reduce  the 
open-loop  model  using  the  modal  residualization  technique,  leaving  only  the  modes 
considered  essential  to  the  control  task.  A suboptimal  filter  (with  respect  to  the  full- 
order  model)  would  then  be  synthesized  using  the  lower  order  airplane  open-loop  model. 
This  approach  was  not  considered  during  this  study. 

Still  another  approach  would  be  to  use  the  full-order  Kalman  filter  to  define  the  required 
control-loop  frequency  responses  over  the  actuation  bandwidth  and  to  design  lower  order 
filters  with  approximately  the  same  frequency  response  characteristics.  This  involves 
least -square  fitting  of-  single-loop  filter  frequency  responses  against  low-order  filters  of 
predetermined  form;  the  procedure  is  described  in  Subsection  E.4.4. 
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E.7.0  CLOSED-LOOP  ANALYSIS 
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E.7.0  CLOSED-LOOP  ANALYSIS 


Closed-loop  analysis  consists  of  evaluating  the  performance  of  full-  and  partial-state 
feedback  designs  and  full-order  and  reduced-order  Kalman  filter  designs  in  terms  of  gust 
response  and  stability  margins.  As  indicated  in  Figure  E-1,  this  analysis  is  an  important 
part  of  an  iterative  design  procedure.  The  design  can  be  divided  into  two  parts:  the 

control  task  and  the  state  estimation  task.  The  control  problem  is  solved  by  synthesizing 
and  analyzing  the  closed-loop  performance  of  full-  or  partial-state  feedbaick  designs. 
After  the  proper  cost  function  and  associate  state  feedback  gain  matrix  have  been 
determined,  the  Kalman  filter  is  synthesized,  inserted  in  the  control  loop,  and  the  closed- 
loop  performance  evaluated.  The  performance  of  various  reduced-order  filters  is 
evaluated  until  one  is  found  that  gives  close  to  optimum  closed-loop  performance  with 
adequate  stability  margins  and  without  imposing  excessive  computational  burden  on  flight 
computers. 


E.7.1  FORMULATION  OF  CLOSED-LOOP  STATE  MODELS 

The  full-state  feedback  closed-loop  model  is  described  by 

X = (A  + BG)x  + Fwg  (E-1 92) 

y = CpX  (E-1 93) 

where  x is  the  state  vector  consisting  of  the  rigid  and  flexible  mode  displacements  and 
rates,  control  surface  states,  and  unsteady  gust  states;  w is  gust  input  vector;  and  y is 

O 

the  output  vector  consisting  of  all  closed-loop  performance  parameters.  A is  the  open- 
loop  state  matrix,  B is  the  control  distribution  matrix,  G is  optimal  state  feedback  gain 
matrix,  F is  the  input  gust  distribution  matrix,  and  Cp  is  the  performance  parameter 
distribution  matrix. 

The  vector  y does  not  contain  any  acceleration  measurements  because  there  are  no  direct 
gust  inputs  in  equation  (E-193).  However,  during  the  gust  response  calculations  described 
in  Section  E.3.0,  the  covariance  matrix  of  y as  well  as  y is  obtained.  This  ensures  that  if  y 
contains  velocity  measurements,  the  corresponding  acceleration  responses  will  also  be 
computed.  A closed-loop  state  model  with  reduced-state  feedback  is  simply  obtained  by 
setting  the  appropriate  columns  in  the  gain  matrix  G to  zero. 
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The  closed-loop  model  with  a full-order  Kalman  filter  is 


X 

"a 

bg" 

X 

'r  ■ 

A 

X 

_SC 

(A+BG-SO 

A 

X 

SE 

(E-194) 


In  addition  to  the  parameters  defined  previously,  there  are  x,  the  estimated  state  vector; 
C,  the  measurement  distribution  matrix;  E,  the  measurement  gust  input  distribution 
matrix;  and  S,  the  optimal  Kalman  filter  input  matrix. 


With  a reduced-order  filter,  the  closed-loop  equations  are  modified  to 


A+BFj^C 
SrC  Ar 


r+BFj^E 

SrE 


w„ 


(E-195) 


where,  in  addition  to  the  terms  defined  previously,  is  the  filter  state  vector,  is  the 
filter  state  matrix  in  block  diagonal  form,  is  the  filter  input  matrix,  is  the  filter 
output  matrix,  and  F^^  is  the  filter  static  gain  matrix.  Figure  E-23  is  a schematic  of  the 
reduced-order  filter.  Equation  (E-193)  represents  the  closed-loop  performance 
parameters. 


S = full-state  estimates 
u = control  vector 
z = reduced-order  filter  states 


• Reduces  order  of  filter 

• Includes  significant  dynamics 

• Preserves  measurement-to-control  static  relationships 


Figure  E-23.  Filter  Simplification 
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E.7.2  CLOSED-LCX5P  STABILITY 


Closed-loop  stability  analysis  consists  of  computing  eigenvalues,  gain  and  phase  margins  in 
all  control  loops  (see  fig.  E-20),  and  the  range  of  values  of  key  parameters  such  as 
dynamic  pressure,  for  which  the  closed-loop  system  remains  stable.  The  various  closed- 
loop  control  laws  are  evaluated  based  on  location  of  closed-loop  poles  and  the  margins  of 
stability  as  a function  of  frequency. 


The  equations  of  the  closed-loop  systems  with  a full-order  Kalman  filter  are  from 
equation  (E-19^)  without  the  input  terms 

X = Ax  + BGx  (nth-order  plant) 

X = (A  + BG-SC)  X + SCx  (nth-order  filter) 


X 

A 

X 


1 

> 

GO 

X 

^SC  A+BG-SC. 

A 

_ X _ 

(E-196) 


The  eigenvalues  of  A are  the  poles  of  the  open-loop  plant  without  the  controller 
connected,  and  the  eigenvalues  of  (A  + BG  - SC)  are  the  poles  of  the  open-loop  Kalman 
filter  with  its  output  disconnected  from  the  plant.  It  is  not  clear,  however,  from  equation 
(E-196)  what  the  poles  of  the  closed-loop  control  system  are. 


Introducing  the  transformation 


\ 

’l  0 ' 

X 

= 

A 

c 

1 -1 

X 

i.e.,  e = X - X,  the  equations  become 


A + BG 
0 


-BG 
A - SC 


(E-197) 


(E-198) 
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From  equation  (E-197),  it  is  clear  that  the  poles  of  the  closed-loop  system,  which  are  the 
eigenvalues  of  the  2n  x 2n  system  matrix  in  equation  (E-197),  are  simply  the  eigenvalues 
of  (A  + BG)  and  the  eigenvalues  of  (A  - SC).  This  follows  from  the  fact  that  matrices 

A -BG' 

SC  A + BG  - SC_ 

and 

A + BG  -BG' 

0 A -SC 


have  the  same  eigenvalues  because  they  are  related  by  the  similarity  transformation 
equation  (E-197),  and  from  the  fact  that 


A + BG -XI  -BG 

0 A - SC  - XI  _ 

= det(A  + BG  - XI)  det(A  - SC  - XI) 


(E-199) 


The  full-state  feedback  system  Inequation  (E-192)J  is  optimal  with  respect  to  the  cost 
function,  stable  if  all  unstable  open-loop  modes  are  controllable,  and  robust  with  respect 
to  parameter  variations  in  the  control  loops.  In  terms  of  the  parameters  defined  in  Figure 
E-20,  the  full-state  feedback  system  has  at  least  the  following  stability  margins  in  each  of 
the  m control  loops 


1/2  < kj  < ® i = 1.  . . m 


and 


dj  < 60  dcsz  i = I m 


Optimal  control  with  full-state  feedback  offers  good  stability  margins.  The  closed-loop 
system  with  the  full-order  Kalman  filter  [equation  (E-198)]  is  always  stable  provided 
that  all  unstable  open-loop  modes  are  controllable  and  observable.  However,  when  the 
Kalman  filter  is  inserted  into  the  control  loop  to  estimate  the  states,  the  good  stability 
margins  of  the  full-state  feedback  design  may  shrink,  sometimes  drastically.  For  the 
closed-loop  system  with  reduced-order  filter  [equation  (E-195)j  , there  is  no  guarantee 
that  the  system  is  stable  even  ax  the  nominal  gain  and  phase. 
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E.7.3  CLOSED-LOOP  ROOT-MEAN-SQUARE  GUST  RESPONSE 


The  steady-state  gust  response  correlation  matrices  for  the  states;  modal  states; 
measurements;  performance  parameters  such  as  bending  moments,  torsional  moments, 
accelerations,  etc.;  and  the  output  power  spectral  density  of  selected  performance 
parameters  are  computed.  The  computational  techniques  are  described  in  Section  E.3.0. 
Because  the  loads  equations  are  based  on  a truncated  set  of  modal  coordinates,  the  load 
levels  are  only  approximate.  However,  because  all  modes  that  are  significant  with 
respect  to  the  control  task  are  included,  and  the  same  truncated  model  has  been  used  to 
compute  the  gust  loads  of  the  open-loop  airplane,  these  approximate  load  calculations  are 
considered  adequate  for  evaluating  the  relative  merits  of  various  control  laws. 

The  closed-loop  gust  response  is  evaluated  in  terms  of  the  relative  reduction  in  the 
related  performance  parameters  and  the  root-mean-square  (rms)  deflections  and  rates  of 
the  control  surfaces.  Because  the  control  surface  positions  and  rates  are  states,  the 
corresponding  rms  gust  responses  are  obtained  from  the  gust  response  correlation  matrix 
for  the  state  vector. 


E.7.4  CLOSED-LOOP  LINEAR  SIMULATIONS 

A closed-loop  system  can  be  defined  either  as  a full-state  feedback  system  or  as  a system 
employing  a state  estimator  (Kalman  filter).  For  a full-state  feedback  system,  the 
equations  can  be  written 


or 


X = Ax  + B ] u 

(E-200) 

u = Gx  + Goiu 

y = Cx  + D^x^^ 

(E-201) 

x + (A+BjG)x +BjB2Uj.  (E-202) 

y = Cx  + D^x^  (E-203) 
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where  u is  the  control  applied  to  the  airplane  and  is  an  external  input.  The  external 
input  for  this  problem  is  5^,  the  column  angle.  A block  diagram  of  the  system  is  shown  in 
Figure  E-2U.  The  system  is  simulated  as  a set  of  difference  equations  in  modal 
coordinates 


z[(k+l)At)  = 0z  [k(At)l  + 011* 
y [k(At)l  = Cz  [k(At)l  +Du* 


(E-204) 


that  were  discussed  in  Subsections  E.3.3  and  E.5.3. 


For  a system  employing  a Kalman  filter  to  estimate  the  states,  the  system  equations  take 


the  form 

X = Ax  + B ] u + Ed  (E-205) 

u = Gx  + (E-206) 

X = Ax  + B|U  + S(y-y)  (E-207) 

y = Cx  + Fv  (,  E-208) 

y = Cx  (E-209) 


f/ffure  E-24.  Full-State  Feedback  System 
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'<>  "<  x> 


where 


d = process  noise 

V = measurement  noise 

estimator  state  vector 
sensor  output  vector 
estimated  sensor  output  vector 
G = full-state  feedback  gain  matrix 
S = Kalman  filter  gain  matrix 

E = process  noise  distribution  matrix 

F = measurement  noise  distribution  matrix 

The  structure  of  the  system  is  shown  in  Figure  E-25. 


Figure  E-25.  Feedback  System  With  Kaiman  Filter 
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The  system  can  be  represented  by  the  dynamic  equations 


X 

■ A 1 
1 

BjG 

1 

A 

X 

SC  I 

A+BiG-SCj 

B j Bt 

"E 

+ 

— 

— 

0 

X 

A 

X 


[ SF 


(E-210) 


These  equations  are  then  converted  to  difference  equations  for  simulation  with  the  noise 


inputs,  d and  v,  set  equal  to  zero. 


E.7.5  EVALUATION  OF  STATE  FEEDBACK  DESIGNS 


The  closed-loop  analysis  of  the  state  feedback  design  is  part  of  the  iterative  design  cycle 
to  solve  the  control  task.  Full-state  feedback  designs  are  evaluated  until  the  proper  cost 
function  and  control  surfaces  have  been  selected.  The  evaluations  are  based  on  gust-load 
reductions,  control  surface  activities,  and  closed-loop  pole  locations. 

Because  the  control  law  includes  feedback  of  control  surface  states,  the  optimal  linear 
regulator  can  be  used  to  determine  whether  or  not  the  control  surface  actuators  have 
sufficient  bandwidth.  If  there  is  a significant  change  in  the  actuator  closed-loop  poles 
from  their  nominal  open-loop  values,  it  will  be  necessary  to  increase  the  actuation 
bandwidth. 


The  trade  between  closed-loop  performance  and  actuation  bandwidth  can  be  determined 
by  considering  the  cumulative  power-spectral-density  plots  of  the  open-loop  and  full-state 
closed-loop  gust  responses  of  the  various  performance  parameters.  The  effects  of 
eliminating  modes  from  the  feedback  can  be  determined  by  evaluating  the  closed-loop 
performance  with  the  appropriate  columns  in  the  optimal  gain  matrix  set  equal  to  zero. 

E.7.6  EVALUATION  OF  KALMAN  FILTER  DESIGNS 

Closed-loop  analysis  of  the  Kalman  filter  designs  is  part  of  the  iterative  design  cycle  to 
solve  the  state  estimation  problem.  Full-order  Kalman  filters  are  evaluated  until  the 
closed-loop  performance  and  stability  margins  meet  or  exceed  the  design  requirements. 
The  key  design  parameters  that  are  evaluated  are  types,  numbers,  and  locations  of  sensors 
and  the  trade  between  gust  response  and  stability  margins.  This  same  iterative  analysis  is 
used  to  evaluate  reduced-order  filters. 
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APPENDIX  F:  FMC  AND  GLA  ANALYSIS  RESULTS 


F.1.0  MODE  SHAPE  MATRICES 


Tables  F-1  and  F-2  show  the  dynamic  loads  and  sensor  mode  shape  matrices  for  the  two 
mass  conditions  (0.46c  and  0.22c  center-of-gravity  positions,  respectively). 


Table  F- 1.  Dynamic  Loads  and  Sensor  Mode  Shape  Matrices  for  0.8F  Mass  (0,46c)  Condition 


Sensors 

Dynamic  loads 

Pitch-rate 
gyro, rad/s 

Wing-tip 
acceler- 
ometer, 
m/$2  (in/$2) 

Inboard  at  7?”  0.25 

Outboard  at  T?  0.75 

Shear,  N 
(lb) 

Bending,  N*m 
(lb-in) 

Torsion,  N'm 
(lb-in) 

Shear,  N 
(lb) 

Bending,  N*m 
(lb-in) 

Torsion,  N’m 
(lb-in) 

Modes 

B 

0 

-2.54  X 10'^ 
(-1.0) 

0 

0 

0 

0 

0 

0 

B 

-8.30  X 10"^ 

-6.98  X 10'^ 
(-0.275) 

0 

0 

0 

0 

0 

0 

B 

-1.32  X 10'^’ 

0 ■ 

0 

0 

0 

0 

0 

0 

B 

1.60  X 10"^ 

0 

0 

0 

0 

0 

0 

0 

‘’12 

0 

-2.54  X 10'^ 
(-1 .0) 

2.74  xIO^ 
(6.17  X 102) 

3.27x10^ 
(2.89  X 10®) 

-3.84  X 10^ 
(-3.40x10®) 

1.22  X 10® 

(2.75  X 102) 

4.60x10® 
(4.07  x 10^) 

5.06  x 10® 
(4.48  X 10®) 

'<13 

0 

-2.54  X 10'^ 
(-1 .0) 

^.63  X 10^ 

(-1.04X  10^) 

-1.22  X 10® 

(-1.08  X 106) 

-4.27x10'* 
(-3.78  X 10®) 

4.67  X 10® 
(1.05  X 10®) 

2.61  X 10^ 
(2.31  X 10®) 

1.45x10® 
(1.28  X 10^) 

‘’14 

0 

-1.49  X 10'^ 
(-0.587) 

0 

0 

0 

0 

0 

0 

''is 

0 

-2.22  X 10'^ 
(-0.875) 

1.04  X 10  ® 
(2.34x104) 

-1.80  X 10® 
(-1.59X  10®) 

5.50  X 10® 
(4.87  X 10®) 

3.15  X 10® 
(7.09  X 1q2) 

3.20  X 10^ 
(2.83x10®) 

1.31  xIO^ 
(1.16x  10®) 

‘'16 

0 

-2.54  X 10'^ 
(-1.0) 

1 .54  X 10^ 
(3.47  X 103) 

-1.27  X 10^ 

(-1.12  X 10®) 

-7.21  X lo'* 
(-6.38x10®) 

-2.21  X 10® 
(-457  X 10®) 

4.35  x10\ 
(3.85x10°) 

-6.61  X 10® 
(-5.85x10^) 

‘'17 

0 

-9.04  X 10'^ 
(-0.356) 

0 

0 

0 

0 

0 

0 

‘’is 

0 

1.66  X 10'^ 
(0.654) 

1.18  xio'* 
(2.66  x103) 

-4.88  X 10® 
(-4.32  X 10®) 

-1.15x10® 

(-1.02x10®) 

1.48x10^ 
(3.32  X 10®) 

-5.21  X 10^ 
(-4.61  X 10®) 

-251  X 10^ 
(-1.96x10®) 

‘>19 

0 

-2.54  X 10’^ 
(-1.0) 

1.10x10^ 
(2.48  X 1q3) 

5.99  X lo’’ 
(5.30x10®) 

3.06x10^ 
12.71  X 10®) 

-552  X 10®, 
(-1.33x10'^) 

1.72x10® 

(1.52x10^) 

-5.76x10'l 

(-5.10x10°) 

Note:  The  wing-load  equations  were  calculated 
by  a "modal  displacement"  technique 
that  relates  wing  load  to  the  wing 
out-of -plane  structural  deflections 
through  the  wing  modes.  Two  wing 
modes  that  are  predominately  in- 
plane bending  are  omitted. 


F-1 


Table  F-2.  Dynamic  Loads  and  Sensor  Mode  Shape  Matrices  for  MZFW+F  Mass  (0.22c)  Condition 


Sensors 

Dynamic  loads 

Pitch-rate 

Wing-tip 
acceler- 
ometer, 
m/$2  (in/s2) 

Inboard  at  t;  0.25 

Outboard  at  " 0.75 

gyro,  rad/s 

Shear,  N 
(lb) 

Bending,  N*m 
(lb-in) 

Torsion,  N*m 
(lb-in) 

Shear,  N 
(lb) 

Bending,  N*m 
(lb-in) 

Torsion,  N-m 
(lb-in) 

B 

0 

-2.54  X 10'^ 
(-1.0) 

0 

0 

0 

0 

0 

0 

B 

-753x10'^* 

-7.82  X 10'^ 
(-0.308) 

0 

0 

0 

0 

0 

0 

B 

-1 .22  X 

10^ 

0 

0 

0 

0 

0 

0 

0 

B 

1.56  X 

10^ 

0 

0 

0 

0 

0 

0 

0 

<’12 

0 

-2.54  X 10’^ 
(-1.0) 

3.12  X 10^ 
(2.76  X 10^) 

-2.69  X 10® 
(-2.38  X 10®) 

1.63x10® 
(3.67  X 10®) 

4.77  X 10® 
(4.22  X 10^) 

-1.08  X 10® 

(-9.55  X 10®) 

vt 

O 

*o 

‘’13 

0 

2.39  X 10'^ 
(0.094) 

0 

0 

0 

0 

0 

0 

s 

‘>14 

0 

-2.54  X 10'^ 
(-1 .0) 

-4.76  X 10^ 
(-1.07  X 10^) 

-9.72  X lO'^ 

(-8.60  X 10^) 

-8.12  X 10*^ 

(-7.19  X 10®) 

-1 .15x  10® 
(-2.59  X 10®) 

2.42  X lO'* 
(2.14  X 10®) 

1.53  X 10® 
(1.35x  10^) 

•’15 

0 

-2.44  X 10'^ 
(-0.962) 

5.07  X 10^ 
(1.14x  10^) 

-1.67  X 10® 
(-1.48  X 10®) 

3.37  X 10® 
(2.98  X 10®) 

-3.70  X 10® 
(-8.32x10®) 

3.36  X 10^ 
(2.97x10®) 

7.23  X 10® 
(6.40  X 10^) 

‘’16 

0 

-2.54  X 10'^ 
(-1 .0) 

1.55  X 10^ 
(3.48  X 10^) 

-7.45  X 10® 
(-6.59x1  o'*) 

-1.20  X 10® 
(-1 .06x  10®) 

-1.11  X 10^* 
(-2.49x10®) 

4.15  X 10^ 
(3.67  X 10®) 

2.80  X 10® 

(2.48  X 10^) 

‘’17 

0 

-9.25  X 10'^ 
(-0.364) 

0 

0 

0 

0 

0 

0 

‘’18 

0 

1.387  X 10'^ 
(0.546) 

-1.34  X 10^ 
(-3.02  X 10^) 

-4.36  X 10® 
(-3.86  X 10®) 

-1 .47  X 10® 
(-1.30  X 10®) 

-1.10  X 10^ 

(-2.47  X 10®) 

-4.81  X 10^ 
(-4.26  X 10®) 

-5.15  X 10^ 
(-4.56  X 10®) 

‘’19 

0 

-2.54  X 10'^ 
(-1 .0) 

1.34  X 10^ 
(3.02  X 10^) 

7.54  X 10^ 
(6.67  X 10®) 

5.04  X 10^* 
(4.46  X 10®) 

1.90  X 10® 
(4.28  X 10®) 

3.57  X 10® 
(3.16  X 10^) 

-5.31  X 10^ 
(-4.70  X 10®) 

Note:  The  wing-load  equations  were  calculated 
bv  a "modal  displacement"  technique 
that  relates  wing  load  to  the  wing 
out-of-plane  structural  deflections 
through  the  wing  modes.  Two  wing 
modes  that  are  predominately  in- 
plane bending  are  omitted. 
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F.2.0  CONTROLLABILITY  ANALYSIS 


Table  F-3  shows  the  relative  flutter-mode  controllability  of  the  various  elevator  and 
aileron  control  surfaces.  Tables  F-^  through  F-7  show  the  relative  root-mean-square 
(rms)  load  open-loop  responses  for  the  various  flight  conditions  due  to  white  noise  inputs 
to  the  actuators. 


Table  F-3.  Relative  Flutter-Mode  Controllability 


Flight 

condition 

Elevator 

Inboard 

aileron 

Outboard  aileron 

Inboard 

Outboard 

Inboard 

and 

outboard 

Inboard 

Outboard 

Inboard 

and 

outboard 

5 

0.15 

0.06 

0.20 

0.42 

0.39 

1.00 

0.99 

6 

0.20 

0.09 

0.28 

0.36 

0.44 

0.97 

1.00 

7 

0.13 

0.03 

0.13 

1.00 

0.50 

0.75 

0.86 

8 

0.19 

0.03 

0.17 

*0.91 

0.53 

0.91 

1.00 

• Assumed  control  authority: 

• Elevator  = +3  deg 

• Aileron  = +15  deg 


• Normalized  for  each  flight  condition 

• 1 indicates  the  control  surface  most  effective 
for  FMC 

• 0 indicates  a control  surface  makes  no 
contribution  to  FMC 
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Table  F-4.  Relative  Root-Mean-Square  Load  Responses  at  Flight  Condition  1 


Elevator 

Outboard  aileron 

Inboard 

Outboard 

Inboard 

and 

outboard 

Inboard 

aileron 

Inboard 

Outboard 

Inboard 

and 

outboard 

Inboard  at 
17  = 0.25: 
Shear 

0.587 

0.430 

1.000 

0.773 

0.468 

0.698 

0.651 

Bending 

moment 

0.617 

0.386 

1.000 

0.418 

0.315 

0.686 

0.871 

Torsion 

0.230 

0.182 

0.405 

1.000 

0.254 

0.781 

0.560 

Outboard  at 
r?  = 0.75 

Shear 

0.396 

0.251 

0.645 

0.369 

0.350 

0.793 

1.000 

Bending 

moment 

0.267 

0.225 

0.477 

0.461 

0.417 

0.857 

1.000 

Torsion 

0.622 

0.380 

1.000 

0.951 

0.424 

0.855 

0.785 

• Assumed  control  authority  (white  noise  at  each  actuator  input): 

• Elevator  = +3  deg 

• Aileron  = +15  deg 


• Nomalized  for  each  flight  condition 

• 1 indicates  the  control  surface  most  effective 
for  load  reduction 

• 0 indicates  a control  surface  makes  no 
contribution  to  toad  reduction 
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Table  F-5.  Relative  Root-Mean-Square  Load  Responses  at  Flight  Condition  2 


Elevator 

Outboard  aileron 

inboard 

Outboard 

Inboard 

and 

outboard 

Inboard 

aileron 

Inboard 

Outboard 

Inboard 

and 

outboard 

Inboard  at 
T?  = 0.25: 
Shear 

0.501 

0.391 

0.873 

1.000 

0.439 

0.634 

0.459 

Bending 

moment 

0.503 

0.315 

0.813 

0.657 

0.391 

0.803 

1.000 

Torsion 

0.299 

0.281 

0.573 

1.000 

0.288 

0.739 

0.505 

Outboard  at 
T?  = 0.75 

Shear 

0.401 

0.260 

0.652 

0.364 

0.418 

0.795 

1.000 

Bending 

moment 

0,164 

0.165 

0.316 

0.583 

0.386 

0.845 

1.000 

Torsion 

0.216 

0.146 

0.350 

0.925 

0.452 

1.000 

0.950 

• Assumed  control  authority  (white  noise  at  each  actuator  input): 

• Elevator  = +3  deg 

• Aileron  = +15  deg 

• Normalized  for  each  flight  condition 

• 1 indicates  the  control  surface  most  effective 
for  load  reduction 

• 0 indicates  a control  surface  makes  no 
contribution  to  load  reduction 
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Table  F-6.  Relative  Root-Mean-Square  Load  Responses  at  Flight  Condition  3 


Elevator 

1 

Outboard  aileron 

Inboard 

Outboard 

Inboard 

and 

outboard 

Inboard 

aileron 

Inboard 

Outboard 

Inboard 

and 

outboard 

Inboard  at 
n = 0.25 
Shear 

0.666 

0.354 

1.000 

0.774 

0.397 

0.734 

0.710 

Bending 

moment 

0.687 

0.316 

1.000 

0.421 

0.295 

0.482 

0.650 

Torsion 

0.246 

0.144 

0.382 

1.000 

0.250 

0.742 

0.653 

Outboard  at 
7}  = 0.75 

Shear 

0.534 

0.251 

0.780 

0.437 

0.403 

0.789 

1.000 

Bending 

moment 

0.317 

0.206 

0.503 

0.531 

0.437 

0.905 

1.000 

Torsion 

0.597 

0.274 

0.868 

0.846 

0.442 

0.978 

i.ooo’ 

• Assumed  control  authority  (white  noise  at  each  actuator  input); 

• Elevator  = +3  deg 

• Aileron  = +15  deg 

• Normalized  for  each  load 

• 1 indicates  the  control  surface  most 
effective  for  load  reduction 

• 0 indicates  a control  surface  makes 
no  contribution  to  load  reduction 


F-6 


Table  F-7.  Relative  Root-Mean-Square  Load  Responses  at  Flight  Condition  4 


Elevator 

Outboard  aileron 

Inboard 

Outboard 

Inboard 

and 

outboard 

inboard 

aileron 

Inboard 

Outboard 

Inboard 

and 

outboard 

Inboard  at 
7?  = 0.25: 

Shear 

0.490 

0.291 

0.760 

1.000 

0.384 

0.670 

0.576 

Bending 

moment 

0.683 

0.322 

1.000 

0.921 

0.428 

0.658 

0.769 

Torsion 

0.275 

0.199 

0.465 

1.000 

0.265 

0.710 

0.654 

Outboard  at 
77  = 0.75: 

Shear 

0.671 

0.342 

0.994 

0.624 

0.522 

0.769 

1.000 

Bending 

moment 

0.192 

0.156 

0.329 

0.741 

0.450 

0.908 

1.000 

Torsion 

0.181 

0.111 

0.274 

0.781 

0.435 

0.967 

1.000 

• Assumed  control  authority  (white  noise  at  each  actuator  input); 

• Elevator  = +3  deg 
•Aileron  = +15  deg 

• Normalized  for  each  load 

• 1 indicates  the  control  surface  most 
effective  for  load  reduction 

• 0 indicates  a control  surface  makes 
no  contribution  to  load  reduction 
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F.3.0  OBSERVABILITY  ANALYSIS 


Figure  F-1  shows  the  various  candidate  locations  for  placing  accelerometers  on  the  wing. 
Figures  F-2  through  F-5  show  the  relative  sensor-to-flutter-mode  coupling  at  the  various 
flight  conditions.  Figures  F-6  through  F-9  show  the  cross-variances  between 
accelerometer  responses  and  wing  bending  moment  responses  for  the  open-loop  airplane  at 
the  various  flight  conditions.  Figures  F-10  through  F-13  show  the  cross-variances 
between  accelerometer  responses  and  wing  bending  moment  responses  for  the  closed-loop 
airplane  (full-state  feedback)  at  the  various  flight  conditions. 
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Figure  F-1.  Candidate  Wing  Accelerometer  Locations 
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Sensor  Coupling  to  Flutter  Modes,  Flight  Condition  5,  Open  Loop 
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Figure  F-3.  Sensor  Coupling  to  Flutter  Modes,  Flight  Condition  6,  Open  Loop 
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Figure  F-4.  Sensor  Coupling  to  Flutter  Modes,  Flight  Condition  7,  Open  Loop 
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Figure  F-5.  Sensor  Coupling  to  Flutter  Modes,  Flight  Condition  8,  Open  Loop 
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Figure  F-6.  Cross-  Variance  Between  Accelerometer  Response  and  Wing 
Bending  Responses,  Flight  Condition  1,  Open  Loop 


Figure  F-7.  Cross-Variance  Between  Accelerometer  Response  and  Wing 
Bending  Responses,  Flight  Condition  2,  Open  Loop 
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Figure  F-8.  Cross-  Variance  Between  Accelerometer  Response  and  Wing 
Bending  Responses,  Flight  Condition  3,  Open  Loop 
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Figure  F-9.  Cross-  Variance  Between  Accelerometer  Response  and  Wing 
Bending  Responses,  Flight  Condition  4,  Open  Loop 


F-13 


0.30  - 
0.25  --(10) 

- 0.20  --(8) 
CM 
w> 

cT  0.15  --(6) 

(A 

"e 

K 0.10  --(4) 


o Inboard  bending 
• Outboard  bending 


> 0.05  -f*(2) 

W»  I 

o 

o 0 “T  (0) 


§ -0.05  -^(-2) 

o 


-0.10 


-0.15 


o 6 


o o o o 


* 

O * 

« 


o * 


.0  o o o ° 


8 12  16 
Sensor  number 


20 


24 


28 


Figure  F- 10.  Cross-  Variance  Between  Acceierometer  Response  and  Wing 
Bending  Responses,  Flight  Condition  1,  Design  A 
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Figure  F- 1 1.  Cross-  Variance  Between  Accelerometer  Response  and  Wing 
Bending  Responses,  Flight  Condition  2,  Design  A 
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Figure  F- 12.  Cross-  Variance  Between  Accelerometer  Response  and  Wing 
Bending  Responses,  Flight  Condition  3,  Design  A 
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Figure  F- 13.  Cross-  Variance  Between  Accelerometer  Response  and 
Wing  Bending  Responses,  Flight  Condition  4,  Design  A 
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F.^f.O  CONTROL  LAW  PERFORMANCE  ANALYSIS 


Numerical  results  of  the  open-  and  closed-loop  characteristics  and  performance  of  the 
airplane  at  the  gust  and  flutter  flight  conditions  are  presented  in  this  section. 

F.4.1  GLA  PERFORMANCE 

F.if.1.1  POWER-SPECTRAL-DENSITY  PLOTS 

Figures  F-14  through  F-29  present  power-spectral-density  (PSD)  plots  of  gust-induced 
wing  bending  and  torsion  for  the  open-  arid  closed-loop  airplanes.  Figures  F-30  through 
F-45  show  PSD  plots  of  the  corresponding  elevator  and  aileron  deflections  and  rates. 
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Figure  F- 1 6.  Normalized  Po  wer-Spectral-Densi ty  Plot, 

Flight  Condition  1 (Outboard  Bending  Moment) 


Figure  F-17.  Normalized  Power-Spectral-Density  Plot, 
Flight  Condition  1 (Outboard  Torsion) 
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Figure  F-18.  Normalized  Power-Spectral- Density  Plot, 


Flight  Condition  2 (Inboard  Bending  Moment) 


Frequency,  rad/s 


Figure  F-19.  Normalized  Power-Spectral-Density  Plot, 
Flight  Condition  2 (Inboard  Torsion) 
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Figure  F-24.  Norrualized  Power-Spectral-Density  Plot, 

Flight  Condition  3 (Outboard  Bending  Moment) 


• Open  loop  — — — 
Design  A » . — 

Design  H — — — — — 


Frequency,  rad/s 

Figure  F-25.  Normalized  Power-Spectra! -Density  Plot, 
Flight  Condition  3 (Outboard  Torsion) 
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Figure  F-27.  Normalized  Power-Spectra! -Density  Plot, 
Flight  Condition  4 (Inboard  Torsion) 
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Figure  F-28.  Normalized  Power-Spectral-Density  Plot, 

Flight  Condition  4 (Outboard  Bending  Moment) 


Flight  Condition  4 (Outboard  Torsion) 
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Figure  F-30.  Power-Spectral-Density  Plot,  Flight  Condition  1 
(Elevator  Displacement) 
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Figure  F-31.  Power-Spectral-Density  Plot,  Flight  Condition  1 
(Elevator  Rate) 
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Figure  F-37.  Power-Spectra! -Density  Riot,  Flight  Condition  2 
(Aileron  Rate) 
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Figure  F-40.  Power-Spectral-Density  Plot,  Flight  Condition  3 
(Aileron  Displacement) 


Figure  F-4 1.  Power-Spectral-Density  Plot,  Flight  Condition  3 
(Aileron  Rate) 


F-31 


Aileron  displacement,  deg 


F.4.1.2  POLE  LOCATIONS 


Tables  F-8  through  F-11  show  the  open-  and  closed-loop  (full-state  feedback)  poles. 
Tables  F-12  through  F-15  show  the  closed-loop  poles  for  the  full-  and  reduced-order 
filters. 


Table  F-8.  Open-  and  Closed-Loop  Dynamic  Model  Poles,  Flight  Condition  7 


Open  loop 

Closed  loop  (design  A) 

Number 

Real, 

rad/s 

Imaginary, 

rad/s 

Magnitude, 

rad/s 

Damping 

ratio 

Real, 

rad/s 

Imaginary, 

rad/s 

Magnitude, 

rad/s 

Damping 

ratio 

1,2 

-3.27  X 10'^ 

i0.l25 

0.130 

0.252 

-4.56  X 10’2 

±1.20  X 10-2 

4.72  X 10-2 

0.970 

3,4 

-0.648 

±0.887 

1.10 

0.590 

-2.43 

± 2.07 

3.19 

0.762 

5,6 

-1.95 

±10.8 

10.9 

0.179 

-8.20 

±15.0 

17.1 

0.480 

7,8 

-0.281 

±15.2 

15.2 

0.018 

-0.462 

±15.1 

15.1 

0.030 

9,  10 

-1.20 

±19.0 

19.0 

0.063 

-1.58 

±18.7 

18.8 

0.084 

11,12 

-0.533 

±21.0 

21.0 

0.025 

-2.58 

±21.5 

21.6 

0.119 

13,  14 

-0.387 

±21.9 

21.9 

0.018 

-0.426 

±21.6 

21.6 

0.020 

15,  16 

-1.97 

±24.1 

24.2 

0.081 

-3.38 

±24.0 

24.2 

0.140 

17.  18 

-1.96 

±34.7 

34.8 

0.056 

-3.00 

±35.3 

35.4 

0.085 

19,  20 

-1 .08 

±36.5 

36.6 

0.030 

-0.980 

±36.3 

36.3 

0.027 

Flexible 

airplane 

21,22 

-2.47 

±47.2 

47.3 

0.052 

-2.70 

±47.3 

47.4 

0.057 

23,  24 

-1.33 

±55.5 

55.5 

0.024 

-1 .30 

±55.5 

55.5 

0.023 

25,26 

-1.96 

±55.5 

55.6 

0.035 

-2.02 

±55.6 

55.6 

0.036 

27,28 

-3.82 

±60.5 

60.6 

0.063 

-4.22 

±60.4 

60.4 

0.070 

29,30 

-7.76 

±75.6 

76.0 

0.100 

-7.77 

±75.6 

76.0 

0.102 

31,32 

-1.99 

±83.1 

83.1 

0.024 

-2.03 

±83.1 

83.1 

33,34 

-5.28 

±93.3 

93.4 

0.056 

-5.46 

±93.4 

93.6 

0.058 

35,  36 

-6.54 

±114.0 

1142 

0.057 

-6.54 

±114.0 

114.2 

0.057  . 

37,38 

-7.20 

±138.0 

1332 

0.052 

-7.20 

±138.0 

138.2 

0.052 

39,40 

-8.31 

±153.0 

153.2 

0.054 

-8.30 

±153.0 

153.2 

0.054 

41,42 

-10.5 

±302.0 

3022 

0.035 

-10.5 

±302.0 

302.2 

0.035 

43 

-1000.0 

H|n|H 

1000.0 

IQi 

-1000.0 

0 

10000 

1.0 

Elevator 

44 

^0.0 

40.0 

19 

-40.0 

0 

40.0 

1.0 

45 

-20.0 

20.0 

BBI 

-20.0 

0 

20.0 

1.0 

■■ 

-1000.0 

HEm 

KM 

-1000.0 

0 

1000.0 

1.0 

Aileron 

mm 

-40.0 

wBm 

19 

-40.0 

0 

40.0 

1.0 

48 

-20.0 

HBH 

91 

-22.2 

0 

22.2 

1.0 

49 

-4.91 

4.91 

1.0 

-4.90 

0 

480 

1.0 

Kussner 

50 

-30.8 

30.8 

1.0 

-30.8 

0 

30.8 

1.0 

51 

-205.0 

205.0 

1.0 

-205.0 

0 

205.0 

1.0 

Gust 

52 

0 

0.478 

1.0 

-0.478 

0 

111 

1.0 

53 

BB 

0 

0.478 

1.0 

-0.478 

0 

1.0 

F-34 


Table  F-9.  Open-  and  Closed-Loop  Dynamic  Model  Poles,  Flight  Condition  2 


Open  loop 

Closed  loop  (design  A) 

Number 

Real 

rad/s 

Imaginary, 

rad/s 

Magnitude, 

rad/s 

Dampinc 

ratio 

Real, 

rad/s 

Imaginary, 

rad/s 

Magnitude, 

rad/s 

Damping 

ratio 

1,2 

-2.96  X 10*2 

±8.08x10*2 

8.61  X 10*2 

0.344 

-4.36  X 10*2 

±2.53  X 10*2 

5.04  X 10*2 

0.865 

3,4 

-0.755 

±1.98 

2.12 

0.356 

-2.06 

±3.00 

3.64 

0.566 

5,6 

-2.03 

±10.8 

11.0 

0.186 

-7.05 

±14.0 

15.6 

0.452 

7,8 

-0.276 

±15.3 

15.3 

0.018 

-0.302 

±15.3 

15.3 

0.020 

9, 10 

-1.14 

±19.6 

19.6 

0.058 

-1 .19 

±19.3 

19.3 

0.062 

11,  12 

-0.724 

±21.1 

21.1 

0.034 

-1.35 

±21.4 

21.4 

0.063 

13, 14 

-0.399 

±22.4 

22.4 

0.018 

-0.430 

±22.3 

22.3 

0.019 

15,16 

-1.98 

±27.2 

27.3 

0.073 

-2.39 

±27.3 

27.4 

0.087 

17, 18 

-2.18 

±35.8 

35.9 

0.061 

-2.31 

±36.0 

36.1 

0.064 

19,  20 

-1.28 

±36.4 

36.4 

0.035 

-1 .26 

±36.3 

36.3 

0.035 

Flexible 

21,22 

-2.21 

±50.0 

50.1 

0.044 

-2.24 

±50.0 

50.1 

0.045 

airplane 

23,  24 

-2.52 

±56.5 

56.6 

0.045 

-2.52 

±56.5 

56.6 

0.045 

25,26 

-2.08 

±63.8 

63.8 

0.033 

-1.94 

±63.8 

63.8 

0.030 

27,  28 

-3.79 

±65.0 

65.1 

0.058 

-4.74 

±65.2 

65.4 

0.072 

29,30 

-4.63 

±74.9 

75.0 

0.062 

-4.72 

±74.8 

74.9 

0.063 

31,32 

-2.58 

±89.2 

89.3 

0.029 

-2.61 

±89.2 

89.2 

0.029 

33,34 

-4.91 

±95.0 

95.1 

0.052 

-5.01 

±95.0 

95.1 

0.053 

35,36 

-6.27 

±117.0 

117.2 

0.054 

-6.27 

±117.0 

117.2 

0.054 

37,38 

-6.80 

±142.0 

142.2 

0.048 

-6.80 

±142.0 

142.2 

0.048 

39,40 

-8.93 

±170.0 

170.2 

0.052 

-8.93 

±170.0 

170.2 

0.052 

41,42 

-11.7 

±306.0 

.306.2 

0.038 

-11.7 

±306.0 

306 

0.038 

43 

-1000.0 

0 

1000.0 

1.0 

-1000.0 

0 

1000.0 

1.0 

Elevator 

44 

-40.0 

0 

40.0 

1.0 

-40.0 

0 

40.0 

1.0 

45 

-20.0 

0 

20.0 

1.0 

-20.0 

0 

20.0 

1.0 

46 

-1000.0 

1000.0 

1.0 

-1000.0 

0 

1000.0 

1.0 

Aileron 

47 

-40.0 

40.0 

1.0 

-41.2 

0 

41.2 

1.0 

48 

-20.0 

HDH 

20.0 

1.0 

-20.3 

0 

20.3 

1.0 

49 

-4.91 

4.91 

1.0 

-4.91 

0 

431 

1.0 

Kussner 

50 

-30.8 

30.8 

1.0 

-30.8 

0 

30.8 

1.0 

51 

-205.0 

205.0 

1.0 

-205.0 

0 

205.0 

1.0 

Gust 

52 

-0.478 

0 

BBI 

1.0 

6 

■Bl 

1.0 

53 

-0.478 

0 

Wm 

1.0 

0 

1.0 

F-35 


Table  F-10.  Open-  and  Closed-Loop  Dynamic  Model  Poles,  Flight  Condition  3 


Open  loop 

Closed  loop  (design  A) 

Number 

Real, 

rad/s 

Imaginary, 

rad/s 

Magnitude, 

rad/s 

Damping 

ratio 

Real, 

rad/s 

Imaginary, 

rad/s 

Magnitude, 

rad/s 

Damping 

ratio 

1.  2 

-2.30  X 10*2 

sO.138 

0.140 

-3.61  X 10*2 

±2.43  X 10*2 

4.35  X 10*2 

0.830 

-0.908 

10.934 

1.30 

0.697 

-3.44 

±2.91 

4.50 

0.764 

-3.42 

±12.9 

13.4 

0.256 

-8.58 

±13.8 

16.2 

0.530 

1.8 

-0.319 

i14.9 

14.9 

0.021 

-0.432 

±14.8 

14.8 

0.029 

9,  10 

-1.12 

±19.3 

19.3 

0.058 

-1.10 

±18.8 

18.8 

0.058 

11, 12 

-0.748 

±20.7 

20.7 

0.036 

-2.81 

±22.3 

22.5 

0.125 

13, 14 

-0.396 

±21.8 

21.8 

0.018 

-0.406 

±21.6 

21.6 

0.019 

15, 16 

-2.27 

±24.5 

24.6 

0.092 

-3.08 

±24.6 

24.8 

0.124  . 

17,  18 

-1.12 

±36.0 

36.0 

0.031 

-1.01 

±36.1 

36.1 

0.028 

19,20 

-3.14 

±36.6 

36.7 

0.086 

-3.65 

±36.8 

37.0 

0.099 

21. 22 

-3.43 

±48.0 

48.1 

0.071 

-3.48 

±48.0 

48.1 

HQ 

Flexible 

airplane 

23,  24 

-1 .29 

±55.4 

55.5 

0.023 

-1 .27 

±55.4 

55.4 

25,  26 

-3.31 

±56.2 

56.3 

0.059 

-3.30 

±56.2 

56.3 

0.059 

27,  28 

-4.47 

±57.1 

57.2 

0.077 

-4.75 

±57.0 

57.2 

0.083 

29,30 

-6.65 

±72.2 

72.5 

0.092 

-0.65 

±72.2 

72.5 

0.092 

31,32 

-2.19 

±83.1 

83.1 

0.026 

-2.23 

±83.1 

83.1 

0.027 

33,34 

-5.46 

±92.0 

92.2 

0.059 

-5.64 

±92.0 

92.2 

0.061 

35, 36 

-8.20 

±111.0 

112.3 

0.073 

-8.20 

±111.0 

112J 

0.073 

37,  38 

-6.98 

±137.0 

137.2 

0.051 

-6.98 

±137.0  • 

137.2 

0.051 

39,40 

-10.0 

±150.0 

151.3 

0.066 

-10.0 

±150.0 

1513 

0.066 

41,42 

-10.6 

±301.0 

301.2 

0.035 

-10.6 

±301.0 

301 .2 

0.035 

43 

-1000.0 

H|nH| 

1000.0 

1.0 

-1000.0 

0 

1000.0 

1.0 

Elevator 

44 

-40.0 

40.0 

1.0 

-40.0 

0 

40.0 

1.0 

45 

-20.0 

HDI 

20.0 

1.0 

-20.0 

0 

20.0 

1.0 

46 

-1000.0. 

1000.0 

1.0 

-1000.0 

0 

1000.0 

1.0 

Aileron 

47 

-40.0 

40.0 

1.0 

^0.3 

0 

40.3 

1.0 

48 

-20.0 

20.0 

1.0 

-19.5 

0 

19.5 

1.0 

49 

1.0 

-5.10 

0 

1.0 

Kussner 

50 

1.0 

-32.0 

0 

1.0 

51 

-213.0 

213.0 

1.0 

-213.0 

0 

213.0 

1.Q 

Gust 

52 

-0.497 

0 

0.497 

1.0 

-0.497 

0 

0.497 

1.0 

53 

-0.497 

0 

0.497 

1.0 

-0.497 

0 

0.497 

1.0 

F-36 


Table  F- 1 1.  Open-  and  Closed-Loop  Dynamic  Model  Poles,  Flight  Condition  4 


Open  Loop 

Closed  Loop 

(Design  A) 

Number 

Real, 

Imaginary, 

Magnitude, 

Damping 

Real, 

Imaginary, 

Magnitude, 

Damping 

rad/s 

rad/s 

rad/s 

ratio 

rad/s 

rad/s 

rad/s 

ratio 

1,2 

-2.41  X 10‘2 

±8.59x10’2 

8.92  X 10*2 

-3.80x10*2 

i 3.16  X 10-2 

4.94  X 10-2 

0.769 

3,4 

-1.03 

±2.28 

2.50 

0.412 

-3.11 

±3.53 

4.70 

0.662 

5,6 

-3.62 

±125 

13.4 

0.270 

-7.99 

±16.1 

18.0 

0.444 

7,8 

-0.306 

±14.9 

14.9 

0.021 

-0.305 

±14.9 

145 

0.020 

9.  10 

-0.766 

±19.9 

19.9 

0.038 

-0.945 

±19.8 

19.8 

0.048 

11,12 

-1.48 

±21.0 

21.1 

0.070 

-1.40 

±21.2 

21 .2 

0.066 

13,  14 

-0.408 

±22.3 

22.3 

0.018 

-0.414 

±22.3 

22.3 

0.018 

15,  16 

-2.57 

±27.3 

27.4 

0.094 

-2.84 

±27.4 

27.5 

0.103 

17, 18 

-0.996 

±36.2 

36.2 

0.028 

-0.986 

±36.2 

36.2 

0.027 

Flexible 

19,20 

21,22 

-3.96 

-3.06 

±37.4 

±50.2 

37.6 

50.3 

0.105 

0.061 

-4.01 

-3.10 

±37.5 

37.7 

50.3 

0.106 

0.062 

airplane 

23,  24 

-2.91 

±56.5 

56.6 

0.051 

-2.91 

±50.2 

±56.5 

56.6 

0.051 

25,26 

-5.03 

±60.5 

60.7 

0.083 

-5.56 

±60.7 

61.0 

0.091 

27,  28 

-2.17 

±64.0 

64.1 

0.034 

-2.21 

*64.0 

64.0 

0.034 

29,30 

-4.60 

±72.0 

72.2 

0.064 

-4.61 

±72.0 

72.1 

0.064 

31,32 

-2.94 

±89.0 

89.0 

0.033 

-2.97 

±89.0 

89.0 

0.033 

33,34 

-5.25 

±94.0 

94.1 

0.056 

-550 

±94.0 

94.2 

0.056 

35,  36 

-8.54 

±114.0 

1145 

0.075 

-8.54 

±114.0 

1145 

0.075 

37,  38 

-7.50 

i141.0 

141.2 

0.053 

-7.50 

±141.0 

1415 

0.053 

39,40 

-9.56 

±166.0 

1665 

0.057 

-9.56 

±166.0 

1665 

0.057 

41,42 

-11.7 

±306.0 

3065 

0.038 

-11.7 

±306.0 

3065 

0.038 

MM 

-1000.0 

1000.0 

1.0 

-1000.0 

0 

1000.0 

1.0 

Elevator 

mm 

-40.0 

40.0 

1.0 

-40.0 

0 

40.0 

1.0 

■9 

-20.0 

■■ 

20.0 

1.0 

-20.0 

0 

20.0 

1.0 

■■ 

-1000.0 

0 

1000.0 

1.0 

-1000.0 

0 

1000.0 

1.0 

Aileron 

MM 

-40.0 

0 

40.0 

1.0 

-41.3 

0 

41.3 

1.0 

48 

-20.0 

0 

20.0 

1.0 

-20.1 

0 

20.1 

1.0 

49 

1.0 

-5.10 

0 

5.10 

1.0 

Kussner 

50 

BH 

1.0 

-32.0 

0 

32.0 

1.0 

51 

-213.0 

■■i 

213.0 

1.0 

-213.0 

0 

213.0 

1.0 

Gust 

52 

-0.497 

0 

0.497 

1.0 

-0.497 

0 

0.497 

1.0 

53 

-0.497 

0 

0.497 

1.0 

-0.497 

0 

0.497 

1.0 

F-37 


Table  F-12.  Closed-Loop  Controller  Poles,  Flight  Condition  1 


Design  B 


Number 

Real, 

rad/s 

Imaginary, 

rad/s 

Magnitude, 

rad/s 

Damping 

ratio 

1,2 

-7.59.x  10*2 

±0.129 

0.150 

0.506 

3,4 

-0.815 

±3.08 

3.19 

0.256 

5,6 

-0.266 

±15.3 

15.3 

0.017 

7,8 

-1.53 

±19.4 

19.5 

0.079 

9,  10 

-0.398 

±21.1 

21.1 

0.019 

11,  12 

-0.385 

±21.9 

21.9 

0.018 

13,14 

-2.06 

±28.0 

28.1 

0.073 

15, 16 

-30.4 

± 6.18 

31.0 

0380 

17,  18 

-1.88 

±34.4 

34.4 

0.054 

19,  20 

-1.27 

±37.1 

37.1 

0.034 

21,  22 

-3.37 

±49.6 

49.7 

0.068 

23,  24 

-1 .30 

±55.5 

55.5 

0.023 

25,  26 

-2.31 

±56.3 

56.3 

0.041 

27,  28 

-26.9 

±65.4 

70.7 

0.380 

29,  30 

-7.74 

±75.9 

76.3 

0.101 

31,32 

-1 .63 

±82.9 

82.9 

0.020 

33,34 

-6.36 

±91.2 

91.4 

0.070 

35,  36 

-6.49 

±114.0 

114.2 

0.057 

37,  38 

-7.20 

±138.0 

138.2 

0.052 

39,40 

-8.31 

±153.0 

153.2 

0.054 

41,42 

-10.5 

±302.0 

302.2 

0.035 

43 

-1000.0 

0 

1000.0 

1.0 

44 

-40.0 

0 

40.0 

1.0 

45 

-20.0 

0 

20.0 

1.0 

46 

-1000.0 

0 

1000.0 

1.0 

47 

-40.0 

0 

40.0 

1.0 

48 

-20.0 

0 

20.0 

1.0 

49 

-1 .04 

0 

1.04 

1.0 

50 

-6.31 

0 

6.31 

1.0 

51 

-203.0 

0 

203.0 

1.0 

52 

53 


-0.105 

-0.257 


1.105 

1.0 

1.257 

1.0 

Design  H 


Number 

Real, 

rad/s 

Imaginary, 

rad/s 

Magnitude, 

rad/s 

IQQIIIII 

1,2 

-3.76  X 10'2 

±3.96  X 10‘2 

5.46  X 10-2 

0.688 

3 

-0.144 

0 

0.144 

1.0 

4 

-0.280 

0 

0.280 

1.0 

5,6 

-0.895 

±3.40 

3.52 

0.254 

7,8 

-6.12 

±1.47 

6.29 

0.972 

F-38 


Table  F-13.  Closed-Loop  Controller  Poles,  Flight  Condition  2 


Design  B 


Design  H 


Number 

Real, 

rad/s 

Imaginary, 

rad/s 

Magnitude, 

rad/s 

Damping 

ratio 

1,2 

-3.43  X 10*2 

±4.76  X 10~2 

5.88  X 10"2 

0.584 

3 

-0.177 

0 

0.177 

1.0 

4 

-0.266 

0 

0.266 

1.0 

5,6 

-0.896 

±3.11 

3.24 

0.277 

7,8 

-6.15 

±1.44 

6.32 

0.974 

F-39 


Table  F- 14.  Closed-Loop  Controller  Poles,  Flight  Condition  3 


Design  B 


Number 

Real, 

rad/s 

Imaginary, 

rad/s 

Magnitude, 

rad/s 

Damping 

ratio 

1,2 

-5.30  X 10-2 

±0.156 

0.165 

0322 

3,4 

-0.650 

±3.16 

3.23 

0.201 

5,6 

-0.284 

±14.9 

14.9 

0.019 

7,8 

-1.65 

±20.0 

20.1 

0.082 

9,  10 

-0.452 

±20.9 

20.9 

0.021 

11,  12 

-0.399 

±21.8 

21.8 

0.018 

13, 14 

-1.99 

±28.7 

28.8 

0.069 

15, 16 

-1 .70 

±35.8 

35.8 

0.047 

17, 18 

-35.9 

±7.14 

36.6 

0.981 

19,  20 

-2.72 

±37.4 

37.5 

0X)72 

21,22 

-4.17 

±49.9 

50.1 

0.083 

23,24 

-1.22 

±55.6 

55.6 

0.022 

25,  26 

-3.49 

±56.6 

56.7 

0.062 

27,  28 

-6.76 

±72.6 

72.9 

0.093 

29,30 

■ -44.1 

±68.8 

81.7 

0.540 

31,32 

-1.43 

±83.1 

83.1 

0.017 

33,  34 

-5.84 

±89.3 

89.5 

0.065 

35,  36 

-8.09 

±111.0 

111.3 

0.073 

37,  38 

-6.98 

±137.0 

137.2 

0.051 

39,40 

-10.0 

±150.0 

1503 

0.067 

41,42 

-10.6 

±301.0 

301.2 

0.035 

43 

-1000.0 

0 

1000.0 

44 

-40.0 

0 

40.0 

WsM 

45 

-20.0 

0 

20.0 

46 

-1000.0 

0 

1000.0 

1.0 

47 

-40.0 

0 

40.0 

1.0 

48 

-20.0 

0 

20.0 

1.0 

49 

-1.13 

0 

1.13 

1.0 

50 

-6.50 

0 

6.50 

1.0 

51 

-208.0 

0 

208.0 

1.0 

52 

-9.62  X 10‘2 

0 

9.62  X 10‘2 

1.0 

53 

-0.273 

0 

0.273 

1.0 

Design  H 


Number 

Real, 

rad/s 

Imaginary, 

rad/s 

Magnitude, 

rad/s 

Damping 

ratio 

1,2 

-3.77  X 10*2 

±2.10  X 10*2 

4.32  X 10*2 

0.874 

3 

-0.156 

0 

0.156 

1.0 

4 

-0.265 

0 

0.265 

1.0 

5,6 

-0.900 

±3.08 

3.21 

0.280 

7,8 

-6.34 

±1.27 

6.46 

0.980 

F-40 


Table  F-15.  Closed-Loop  Controller  Poles,  Flight  Condition  4 

Design  B 


Number 

Real, 

rad/s 

Imaginary, 

rad/s 

Magnitude, 

rad/s 

1.2 

-4.71  X 10"2 

±7.50  X 10-2 

8.86x10-2 

3,4 

-1.14 

±3.77 

3.94 

5,6 

-0.286 

±14.9 

14.9 

7,8 

-1 .55 

±20.7 

20.8 

9,  10 

-0.780 

±21.0 

21.0 

11,  12 

-0.415 

±22.4 

22.4 

13,  14 

-1.07 

±34.4 

34.4 

15,  16 

-3.90 

±36.3 

36.5 

17,  18 

-35.9 

±6.83 

36.5 

19,  20 

-2.72 

±39.2 

39.3 

21,22 

-3.77 

±50.5 

50.6 

23,  24 

-3.03 

±57.1 

57.2 

25,  26 

-2.02 

±64.1 

64.1 

27,  28 

-4.39 

±71.6 

71.7 

29,  30 

-44.8 

±65.9 

79.7 

31,32 

-6.42 

±92.4 

92.6 

33,34 

-2.85 

±93.4 

93.4 

35,  36 

-8.42 

±114.0 

1143 

37,38 

-7.49 

±141.0 

141.2 

39, 40 

-9.58 

±166.0 

1663 

41,42 

-11.7 

±306.0 

306.2 

-1000.0 

-40.0 

-20.0 


-1000.0 

-40.0 

-20.0 


-2.39 

-6.50 

-209.0 


-0.156 

-0.262 


Number 

Real, 

rad/s 

Imaginary, 

rad/s 

Magnitude, 

rad/s 

Damping 

ratio 

1,2 

-3.20  X 10-2 

±4.71  X 10-2 

5.69  X 10-2 

0.561 

3 

-0.187 

0 

0.187 

1.0 

4 

-0.255 

0 

0.255 

1.0 

5,6 

-0.781 

±3.06 

3.16 

0.248 

7,8 

-6.41 

±1.22 

6.52 

0.982 

F-4I 


F.4.1.3  STABILITY  MARGINS 


Figures  F-46  through  F-81  show  Bode  plots  for  the  aileron  and  elevator  control  loops  with 
various  filters  and  at  the  gust-load  flight  conditions. 


F-42 


Stability  margin  satisfied 


Stability  margin  not  satisfied 


SB 

SB 


0.01  0.02  0.05  0.1  0.2  0.5  1 2 5 10  20  50  100 

Frequency,  rad/s 

Figure  F-46.  Phase  and  Gain  Margin,  Elevator  Loop,  Filter  Type  B,  Flight  Condition  1 
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Figure  F-47.  Phase  and  Gain  Margin,  Aileron  Loop,  Filter  Type  B,  Flight  Condition  1 
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Figure  F-48.  Phase  and  Gain  Margin,  Elevator  Loop,  Filter  Type  B,  Flight  Condition  2 
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Figure  F-49.  Phase  and  Gain  Margin,  Aileron  Loop,  Filter  Type  B,  Flight  Condition  2 


F-44 


Phase,  deg  Phase,  deg 


Gain,  dB  Gain,  dB 


Frequency,  rad/s 

Figure  F-50.  Phase  and  Gain  Margin,  Elevator  Loop,  Filter  Type  B,  Flight  Condition  3 
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Figure  F-51.  Phase  and  Gain  Margin,  Aileron  Loop,  Filter  Type  B,  Flight  Condition  3 
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Figure  F-52.  Phase  and  Gain  Margin,  Elevator  Loop,  Filter  Type  B,  Flight  Condition  4 
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Figure  F-53.  Phase  and  Gain  Margin,  Aileron  Loop,  Filter  Type  B,  Flight  Condition  4 
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Figure  F-54.  Phase  and  Gain  Margin,  Elevator  Loop,  Filter  Type  C,  Flight  Condition  1 
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Figure  F-55.  Phase  and  Gain  Margin,  Aileron  Loop,  Filter  Type  C,  Flight  Condition  1 
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Figure  F-56.  Phase  and  Gain  Margin,  Elevator  Loop,  Filter  Type  C,  Flight  Condition  3 
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Figure  F-57.  Phase  and  Gain  Margin,  Aileron  Loop,  Filter  Type  C,  Flight  Condition  3 
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Figure  F-58.  Phase  and  Gain  Margin,  Elevator  Loop,  Filter  Type  D,  Flight  Condition  1 


Figure  F-59.  Phase  and  Gain  Margin,  Aileron  Loop,  Filter  Type  D,  Flight  Condition  1 
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Figure  F-60.  Phase  and  Gain  Margin,  Elevator  Loop,  Filter  Type  D,  Flight  Condition  2 


Figure  F-61 . Phase  and  Gain  Margin,  Aileron  Loop,  Filter  Type  D,  Flight  Condition  2 


F-50 


Phase,  deg  Phase,  deg 


Gain,  dB  Gain,  dB 


0 


-90 


-180 

-270 

-360 


0.01  0.02  0.05  0.1  0.2  0.5  1 2 5 10  20  50  100 


Frequency,  rad/s 


Figure  F-62.  Phase  and  Gain  Margin,  Elevator  Loop,  Filter  Type  D,  Flight  Condition  3 
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Figure  F-64.  Phase  and  Gain  Margin,  Elevator  Loop,  Filter  Type  D,  Flight  Condition  4 
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Figure  F-65.  Phase  and  Gain  Margin,  Aileron  Loop,  Filter  Type  D,  Flight  Condition  4 
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Figure  F-66.  Phase  and  Gain  Margin,  Elevator  Loop,  Filter  Type  E,  Flight  Condition  1 
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Figure  F-67.  Phase  and  Gain  Margin,  Aileron  Loop,  Filter  Type  E,  Flight  Condition  1 
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Figure  F-68.  Phase  and  Gain  Margin,  Elevator  Loop,  Filter  Type  E,  Flight  Condition  2 
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Figure  F-69.  Phase  and  Gain  Margin,  Aileron  Loop,  Filter  Type  E,  Flight  Condition  2 
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Figure  F-72.  Phase  and  Gain  Margin,  Elevator  Loop,  Filter  Type  E,  Flight  Condition  4 


■ T- 


Stability  margin  satisfied 


[ = Stability  margin  not  satisfied 


0.01  0.02  0.05  0.1  0.2  0.5  1 2 

Frequency,  rad/s 


5 10  20  50  100 


Figure  F-73.  Phase  and  Gain  Margin,  Aileron  Loop,  Filter  Type  E,  Flight  Condition  4 
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Figure  F-74.  Phase  and  Gain  Margin,  Elevator  Loop,  Fitter  Types  F and  H,  Flight  Condition 
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Figure  F-75.  Phase  and  Gain  Margin,  Aileron  Loop,  Filter  Types  F and  H,  Flight  Condition  1 
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Figure  F-76.  Phase  and  Gain  Margin,  Elevator  Loop,  Fitter  Types  F and  H,  Flight  Condition  2 
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Figure  F-77.  Phase  and  Gain  Margin,  Aileron  Loop,  Filter  Types  F and  H,  Flight  Condition  2 
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\gure  F-78.  Phase  and  Gain  Margin,  Elevator  Loop,  Filter  Types  F and  H,  Flight  Condition  i 
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Figure  F-79.  Phase  and  Gain  Margin,  Aileron  Loop,  Filter  Types  F and  H,  Flight  Condition  3 
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F.4.2  FMC  PERFORMANCE 


F.4.2.1  POLE  LOCATIONS 

Tables  F-16  through  F-19  show  the  open-  and  closed-loop  (full-state  feedback)  pole 
locations.  Tables  F-20  through  F-23  show  the  closed-loop  pole  locations  for  full-  and 
reduced-order  filters. 


Table  F-16.  Open-  and  Closed-Loop  Dynamic  Model  Poles,  Flight  Condition  5 


Open  loop 

Closed  loop  {design  A) 

Number 

Real, 

Imaginary, 

Magnitude, 

Damping 

Real, 

, Imaginary, 

Magnitude, 

Damping 

■ 

rad/s 

rad/s 

rad/s 

radio 

rad/s 

rad/s 

rad/s 

ratio 

1,2 

-1.77  X 10-2 

±0.159 

0.160 

0.111 

-3.02  X 10-2 

±5.00  X 10-2 

5.84x10-2 

0.517 

3,4 

-1.19 

±0.845 

1.46 

0.816 

-3.10 

±3.17 

4.43 

0.699 

5,6 

-0.321 

±14.3 

14.3 

0.022 

-0.387 

±14.4 

14.4 

0.027 

7,8 

-7.48 

±16.4 

18.0 

0.416 

-10.1 

±16.3 

19.2 

0.528 

9, 10 

3.51  X 10-2 

±19.8 

19.8 

-0.002 

-1.55 

±19.1 

19.2 

0.080 

11, 12 

-1.64 

±20.4 

20.5 

0.080 

-2.15 

±22.0 

22.1 

0.097 

13,  14 

-0.383 

±21.8 

21.8 

0.018 

-0.422 

±21.6 

21.6 

0.020 

15,  16 

-2.00 

±24.5 

24.6 

0.081 

-2.56 

±24.7 

248 

0.103 

17, 18 

-0.916 

±36.0 

36.0 

0.025 

-0.910 

±36.0 

36.0 

0.025 

19,20 

-5.10 

±38.5 

38.8 

0.131 

-5.20 

±38.6 

38.9 

0.133 

Flexible 

21,22 

-6.26 

±48.5 

48.9 

0.128 

-6.30 

±48.4 

48.8 

0.129 

airplane 

23,  24 

-3.71 

±51.3 

51.4 

0.074 

-3.80 

±51.3 

51.4 

0.074 

25,26 

-1.27 

±55.6 

55.6 

0.023 

-1.27 

±55.6 

55.6 

0.023 

27,28 

-5.49 

±56.6 

56.9 

0.096 

-5.51 

±56.6 

56.9 

0.097 

29,  30 

-5.52 

±69.2 

69.4 

0.080 

-5.53 

±69.2 

69.4 

0.080 

31,32 

-2.54 

±82.6 

82.7 

0.031 

-2.55 

±82.6 

82.6 

0.031 

33,  34 

-5.79 

±90.6 

90.8 

0.064 

-5.87 

±90.7 

90.9 

0.064 

35,  36 

-11.0 

±107.0 

107.6 

0.102 

-11.0 

±107.0 

107.6 

0.102 

37,38 

-7.04 

±136.0 

136.2 

0.052 

-7.04 

±136.0 

136.2 

0.052 

39,40 

-11.7 

±146.0 

146.5 

0.080 

-11.7 

±146.0 

146.5 

0.080 

41,42 

-10.8 

±300.0 

301.2 

0.036 

-108 

±300.0 

301.2 

0.036 

43 

-1000.0 

lai 

-1000.0 

0 

1000.0 

1.0 

Elevator 

44 

-40.0 

-40.0 

0 

40.0 

1.0 

45 

-20.0 

|g| 

-20.0 

0 

20.0 

1.0 

46 

-1000.0 

■Qi 

-1000.0 

0 

1000.0 

1.0 

Aileron 

47 

-40.0 

19 

-40.3 

0 

40.3 

1.0 

48 

-20.0 

19 

-19.3 

0 

19.3 

1.0 

49 

-5.3 

5.3 

1.0 

-5.3 

0 

6.3 

1.0 

Kussner 

50 

-33.3 

33.3 

1.0 

-33.3 

0 

33.3 

1.0 

51 

-221.0 

221.0 

1.0 

-221.0 

0 

221.0 

1.0 

Gust 

52 

0 

1.0 

-0.517 

1.69  X 10“^ 

1.0 

53 

0 

1.0 

-0.517 

-1.69  X 10-^ 

1.0 

F-61 


Table  F-17.  Open-  and  Closed-Loop  Dynamic  Model  Poles,  Flight  Condition  6 


Number 

Real, 

rad/s 

1,2 

-2.32  X 10" 

3,4 

-1.34 

5,  6 

-0.317 

7,8 

-8.18 

9,  10 

0.102 

11,  12 

-2.31 

13,  14 

-0.389 

15,  16 

-2.79 

17,  18 

-0.988 

Flexible 

airplane 

19,  20 
21,22 
23,24 
25,26 
27,  28 
29,  30 
31, 32 
33,  34 
35,36 
37,38 
39,40 
41,42 

-6.20 

-5.20 

-5.10 

-3.33 

-2.80 

-4.44 

-3.42 

-5.67 

-11.7 

-8.22 

-10.3 

-11.8 

43 

-1000.0 

Elevator 

44 

-40.0 

45 

-20.0 

46 

-1000.0 

Aileron 

47 

,40.0 

48 

-20.0 

49 

-5.30 

Kussner 

50 

-33.3 

51 

-221.0 

Gust 

52 

-0.517 

53 

-0.517 

Open  loop 

Closed  loop  (design  A) 

Imaginary, 

Magnitude, 

Damping 

Real, 

Imaginary, 

Magnitude, 

Damping 

rad/s 

rad/s 

ratio 

rad/s 

rad/s 

rad/s 

ratio 

±9.25  X 10-2 

9.54  X 10*2 

0.243 

-2.96x  10“2 

±4.65  X 10*2 

5.51  x10*2 

0.537 

±2.55 

2.88 

0.466 

-3.10 

±4.17 

5.20 

0.597 

±14.3 

14.3 

0.022 

-0.349 

±14.3 

14.3 

0.024 

±16.6 

18.5 

0.442 

-12.8 

±213 

30.0 

0.516 

±19.8 

19.8 

-0.005 

-1 .48 

±19.8 

19.8 

0.074 

±21.5 

21.6 

0.107 

-2.44 

±223 

22.3 

0.109 

±22.3 

22.3 

0.017 

-0.410 

±223 

22.2 

0.018 

±26.7 

26.9 

0.104 

-3.08 

±27.1 

27.3 

0.113 

±36.2 

36.2 

0.027 

-0.944 

±36.2 

36.2 

±40.0 

40.5 

0.153 

-6.31 

±40.0 

40.5 

±50.6 

50.9 

0.102 

-5.66 

±50.8 

51.1 

0.111 

±53.4 

53.6 

0.095 

-5.45 

±53.2 

53.5 

0.102 

±56.4 

56.5 

0.059 

-3.33 

±56.4 

56.5 

0.059 

±63.8 

63.9 

0.044 

-2.84 

63.9 

0.044 

±69.4 

69.5 

0.064 

-4.41 

69.5 

0.063 

±88.7 

88.7 

0.039 

-3.44 

±88.7 

88.8 

0.039 

±93.0 

93.1 

0.061 

-5.77 

±93.0 

93.2 

0.062 

±109.0 

109.6 

0.107 

-11.7 

±109.0 

109.6 

0.107 

±139.0 

139.2 

0.059 

-8.22 

±139.0 

139.2 

0.059 

±163.0 

1633 

0.063 

-10.3 

±163.0 

1633 

0.063 

±305.0 

305.2 

0.039 

-11.8 

±305.0 

3053 

0.039 

0 

1000.0 

1.0 

-1000.0 

0 

1000.0 

1.0 

0 

40.0 

1.0 

-40.0 

0 

40.0 

1.0 

0 

20.0 

1.0 

-20.0 

+6.50  X 10*2 

20.0 

1.0 

0 

1000.0 

1.0 

-1000.0 

0 

1000.0 

1.0 

0 

40.0 

1.0 

-42.6 

0 

42.6 

1.0 

0 

20.0 

1.0 

-20.0 

-6.50  X 10*2 

20.0 

1.0 

0 

5.30 

1.0 

-5.30 

0 

5.30 

1.0 

0 

33.3 

1.0 

-33.3 

0 

33.3 

1.0 

0 

221.0 

1.0 

-221.0 

0 

221.0 

1.0 

0 

0.517 

1.0 

0.517 

1.0 

0 

0.517 

1.0 

0.517 

1.0 
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Table  F- 18.  Open-  and  Closed-Loop  Dynamic  Model  Poles,  Flight  Condition  7 


Open  loop 

Closed  loop  (design  A) 

Number 

Real, 

Imaginary, 

Magnitude, 

Damping 

Real, 

Imaginary, 

Magnitude, 

Damping 

rad/s 

rad/s 

rad/s 

ratio 

rad/s 

rad/$ 

rad/s 

ratio 

1,2 

-8.18  X 10-3 

±0.219 

0.219 

0.037 

-5.78  X 10*2 

±0.119 

0.132 

0.438 

3,4 

-1.46 

±0.192 

1.47 

0.993 

-1.83 

±1.56 

2.40 

0.760 

5,6 

-0.342 

±13.4 

13.4 

0.026 

-0.372 

±135 

13.5 

0.028 

7,8 

0.286 

±20.5 

20.5 

-0.014 

-1.18 

±21.2 

21.2 

0.055 

9,  10 

-2.15 

±20.8 

20.9 

0.103 

-1  £9 

±19.7 

19.8 

0.095 

11,  12 

-0.380 

±21.8 

21.8 

0.017 

-0.429 

±21.7 

21.7 

0.020 

13,  14 

-0.358 

±25.7 

25.7 

0.014 

-3.14 

±25.4 

25.6 

0.122 

15,  16 

-20.5 

±16.7 

26.5 

0.775 

-25.9 

±29.1 

39.0 

0.665 

17,  18 

-1.08 

±36.4 

36.4 

0.030 

-1.02 

±36.1 

36.1 

0.028 

19,20 

-3.40 

±37.1 

37.2 

0.091 

-3.52 

±39.1 

39.2 

0.089 

21,22 

-2.64 

±44.1 

44.2 

0.060 

-3.08 

±44.0 

44.1 

0.070 

Flexible 

23,24 

-5.70 

±51.8 

52.1 

0.110 

-5.65 

±51.9 

52.2 

0.108 

airplane 

25,26 

-1.04 

±55.3 

55.3 

0.019 

-1.04 

±55.3 

55.3 

0.019 

27,28 

-14.9 

±59.3 

61.1 

0.244 

-14.9 

±59.3 

61.1 

0244 

29,  30 

-3.66 

±65.0 

65.1 

0.056 

-3.68 

±65.0 

65.1 

0.056 

31,  32 

-3.20 

±82.5 

82.5 

0.039 

-323 

±825 

82.5 

0.039 

33,  34 

-5.90 

±89.0 

892 

0.066 

-6.06 

±89.0 

89.2 

0.068 

35,36 

-14.7 

±97.4 

98.5 

0.149 

-14.7 

±97.4 

98.5 

0.149 

37,38 

-7.49 

±135.0 

135.2 

0.055 

-7.49 

±135.0 

1352 

0.055 

39,40 

-12.2 

±140.0 

140.5 

0.086 

-122 

±140.0 

140.5 

0.086 

41,42 

-11.0 

±300.0 

3002 

0.037 

-11.0 

±300.0 

300.2 

0.037 

43 

-1000.0 

0 

1000.0 

1.0 

-1000.0 

0 

1000.0 

1.0 

Elevator 

44 

-40.0 

0 

40.0 

1.0 

-40.0 

0 

40.0 

1.0 

45 

-20.0 

0 

20.0 

1.0 

-20.0 

0 

20.0 

1.0 

46 

-1000.0 

0 

1.0 

-1000.0 

0 

1000.0 

1.0 

Aileron 

47 

-40.0 

0 

40.0 

1.0 

-48.1 

0 

48.1 

1.0 

48 

-20.0 

0 

20.0 

1.0 

-22  £ 

0 

22.8 

1.0 

49 

-5.51 

0 

5.51 

1.0 

WBSM 

0 

5.51 

1.0 

Kussner 

50 

0 

34.6 

•1.0 

0 

34.6 

1.0 

51 

0 

230.0 

1.0 

0 

230.0 

1.0 

Gust 

52 

-0.537 

0 

1.0 

0 

1.0 

53 

.0.537 

0 

1.0 

0 

1.0 

F-63 


Table  F-19.  Open-  and  Closed-Loop  Dynamic  Model  Poles,  Flight  Condition  8 


Open  loop 

Closed  loop 

(design  A) 

Number 

Real, 

rad/s 

Imaginary. 

rad/s 

Magnitude, 

rad/s 

Damping 

ratio 

Real, 

rad/s 

Imaginary, 

rad/s 

Magnitude, 

rad/s 

Damping 

ratio 

1,  2 

-2.94  X 10-2 

±0.108 

0.112 

0.263 

-3.09  X 10-2 

±0.104 

0.109 

0.284 

3 4 

-1.63 

±2.90 

3.33 

0.490 

-1.62 

±2.91 

3.33 

0.486 

5,6 

-0.341 

±13.4 

13.4 

0.025 

-0.348 

±13.4 

13.4 

0.026 

7,8 

0.227 

±20.3 

20.3 

-0.011 

-0.442 

±20.2 

20.2 

0.022 

9,  10 

-2.72 

±22.1 

22.3 

0.122 

-2.53 

±22.2 

22.4 

0.113 

11,  12 

-0.373 

±22.3 

22.3 

0.017 

-0.394 

±22.3 

22.3 

0.018 

13,  14 

-23.6 

±13.7 

27.3 

0.864 

-25.8 

±25.3 

36.1 

0.714 

15,  16 

-0.498 

±27.8 

27.8 

0.017 

-3.11 

±28.1 

28.3 

0.110 

17,  18 

-1.24 

±36.0 

36.1 

0.034 

-1.13 

±36.0 

36.0 

0.031 

19,  20 

-1.80 

±41.7 

41.8 

0.043 

-2.25 

±41.9 

42.0 

0.053 

Flexible 

airplane 

21,22 

-3.71 

±45.1 

45.2 

0.082 

-4.06 

±45.4 

45.6 

0.089 

23,24 

-13.5 

±53;4 

55.1 

0.244 

-13.4 

±53.4 

55.0 

0.244 

25,  26 

-2.29 

±56.4 

56.4 

0.041 

-2.33 

±56.4 

56.4 

0.041 

27,28 

-6.02 

±63.1 

63.4 

0.095 

-6.01 

±63.1 

63.4 

0.095 

29,  30 

-3.34 

±67.0 

67.1 

0.050 

-3.38 

±67.0 

67.1 

0.050 

. 31,32 

-4.07 

±88.2 

88.3 

0.046 

-4.07 

±88.2 

88.3 

0.046 

33,  34 

-6.12 

±91.7 

91.9 

0.067 

-6.15 

±91.6 

91.8 

0.067 

35,36 

-15.0 

±99.0 

100.1 

0.150 

-15.0 

±99.0 

100.1 

0.150 

37,  38 

-9.06  ■ 

±137.0 

137.3 

0.066 

-9.05 

±137.0 

137.3 

0.066 

39,  40 

-10.8 

±159.0 

159.4 

0.068 

-108 

±159.0 

159.4 

0.068 

41,42 

-12.0 

±304.0  • 

304.2 

0.040 

-12.0 

±304.0 

304.2 

0.040 

43 

-1000.0 

1000.0 

1.0 

-1000.0 

0 

1 000.0 

'l.O 

Elevator 

44 

-40.0 

mSm 

40.0 

1.0 

-40.0 

0 

40.0 

1.0 

45 

-20.0 

■■ 

20.0 

1.0 

-20.0 

0 

20.0 

1.0 

46 

-1000.0 

0 

1000.0 

1.0 

-1000.0 

0 

1000.0 

1.0 

Aileron 

47 

-40.0 

0 

40.0 

1.0 

-47.7 

0 

47.7 

1.0 

48 

-20.0 

0 

20.0 

1.0 

-22.3 

0 

22.3 

1.0 

49 

-5.51 

5.51 

1.0 

-5.51 

0 

5.51 

1.0 

Kussner 

50 

-34.6 

34.6 

1.0 

-34.6 

0 

34.6 

1.0 

51 

-230.0 

230.0 

1.0 

-230.0 

0 

230.0 

1.0 

Gust 

52 

0 

1.0 

0 

1.0 

53 

0 

1.0 

0 

1.0 
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Table  F-20.  Closed-Loop  Controller  Poles,  Flight  Condition  5 


Design  B 


Design  H 
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Table  F-21.  Closed-Loop  Controller  Poles,  Flight  Condition  6 

Design  B 


Design  H 


Number 

Real, 

rad/s 

Imaginary, 

rad/s 

Magnitude, 

rad/s 

Damping 

ratio 

1,2 

-2.79  X 10'^ 

+9.42  X 10'^ 

2.94  X 10'^ 

0.947 

3,4 

-0.235 

+5.19  X 10'^ 

0.241 

0.976 

5,6 

-1.07 

+4.13 

4.27 

0.251 

7,8 

-2.38 

+20.2 

20J 

0.117 
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Table  F-22.  Closed-Loop  Controller  Poles,  Flight  Condition  7 

Design  6 


Damping 

ratio 


Number 

Real, 

imaginary. 

Magnitude, 

rad/s 

rad/s 

rad/s 

1,2 

-1.45x  10'^ 

+0.207 

0.208 

3,4 

-0.474 

+3.36 

3.39 

5,6 

-0.345 

+ 13.5 

13.5 

7,8 

-0.410 

+20.6 

20.6 

9, 10 

-2.06 

+20.9 

21.0 

11, 12 

-0.404 

+21.8 

21.8 

13, 14 

-2.18 

+28.6 

28.7 

15,  16 

-1.00 

+36.0 

36.0 

17, 18 

-6.58 

+44.8 

45.3 

19,  20 

-47.9 

+3.56 

48.0 

21,22 

-6.30 

+50.5 

50.9 

23,  24 

-1 .03 

+55.3  . 

55.3 

25,  26 

-15.1 

+ 59.7 

61.5 

27,28 

-4.30 

+66.1 

66.2 

29, 30 

-1.57 

+83.2 

83.2 

31,32 

-5.06 

+88.2 

88.3 

33, 34 

-14.3 

+97.6 

98.6 

35,  36 

-109.0 

+67.4 

128.2 

37,  38 

-7.47 

+ 135.0 

135.2 

39, 40 

-12.2 

+140.0 

140.5 

41,42 

-11.0 

+300.0 

300.2 

Number 

Imaginary, 

rad/s 

Magnitude, 

rad/s 

1,2 

-2.77  X 10'^ 

+9.77  X 10"^ 

2.94x10*^ 

3,4 

-0.237 

+5.17x10*^ 

0.243 

5,6 

-1.11 

+4.03 

4.18 

7,8 

-2.13 

+ 18.4 

18.5 

Damping 

ratio 
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Table  F-23.  Closed-Loop  Controller  Poles,  Flight  Condition  8 

Design  B 


Design  H 


Nunnber 

Real, 

rad/s 

Magnitude, 

rad/s 

Damping 

ratio 

1.  2 

-2.77  X 10'® 

+9.78  X 10'^ 

0.943 

0.943 

3,4 

-0.239 

+5.33x10*^ 

0.245 

0.976 

5,6 

-1.11 

+4.01 

4.16 

0.266 

7,8 

-1.68 

+19.0 

19.1 

0.088 
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F.4.2.2  STABILITY  MARGINS 


Figures  F-82  through  F-115  are  Bode  plots  for  the  aileron  and  elevator  control  loops  with 
various  filters  and  at  the  flutter  flight  conditions. 
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^igure  F-82.  Phase  and  Gain  Margin,  Elevator  Loop,  Filter  Type  B,  Flight  Condition  5 
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Figure  F-83.  Phase  and  Gain  Margin,  Aileron  Loop,  Filter  Type  B,  Flight  Condition  5 
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Figure  F-84.  Phase  and  Gain  Margin,  Elevator  Loop,  Filter  Type  B,  Flight  Condition  6 
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Figure  F-85.  Phase  and  Gain  Margin,  Aileron  Loop,  Filter  Type  B,  Flight  Condition  6 
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Figure  FSB.  Phase  and  Gain  Margin,  Elevator  Loop,  Filter  Type  B,  Flight  Condition  7 
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Figure  FS7.  Phase  and  Gain  Margin,  Aileron  Loop,  Filter  Type  B,  Flight  Condition  7 
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Figure  F-88.  Phase  and  Gain  Margin,  Elevator  Loop,  Fitter  Type  B,  Flight  Condition  8 
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Figure  F-89.  Phase  and  Gain  Margin,  Aileron  Loop,  Filter  Type  B,  Flight  Condition  8 
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Figure  F-90.  Phase  and  Gain  Margin,  Elevator  Loop,  Fitter  Type  C,  Flight  Condition  5 


Figure  F-91.  Phase  and  Gain  Margin,  Aileron  Loop,  Filter  Type  C,  Flight  Condition  5 
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Figure  F-92.  Phase  and  Gain  Margin,  Elevator  Loop,  Filter  Type  C,  Flight  Condition  6 
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Figure  F-93.  Phase  and  Gain  Margin,  Aileron  Loop,  Filter  Type  C,  Flight  Condition  6 
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Figure  F-94.  Phase  and  Gain  Margin,  Elevator  Loop,  Fitter  Type  D,  Flight  Condition  5 


Figure  F-95.  Phase  and  Gain  Margin,  Aileron  Loop,  Filter  Type  D,  Flight  Condition  5 
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Figure  F-96.  Phase  and  Gain  Margin,  Elevator  Loop,  Filter  Types  D and  G,  Flight  Condition 


Frequency,  rad/s 


Figure  F-97.  Phase  and  Gain  Margin,  Aileron  Loop,  Filter  Types  D and  G,  Flight  Condition  6 
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Figure  F-98.  Phase  and  Gain  Margin,  Elevator  Loop,  Filter  Type  D,  Flight  Condition  7 
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Figure  F-99.  Phase  and  Gain  Margin,  Aileron  Loop,  Filter  Type  D,  Flight  Condition  7 
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Figure  F-100.  Phase  and  Gain  Margin,  Elevator  Loop,  Filter  Type  D,  Flight  Condition 
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Figure  F-101.  Phase  and  Gain  Margin,  Aileron  Loop,  Filter  Type  D,  Flight  Condition  8 
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Figure  F-102.  Phase  and  Gain  Margin,  Elevator  Loop,  Filter  Type  G,  Flight  Condition  5 


Figure  F-103.  Phase  and  Gain  Margin,  Aileron  Loop,  Filter  Type  G,  Flight  Condition  5 
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Figure  F-104.  Phase  and  Gain  Margin,  Elevator  Loop,  Filter  Type  G,  Flight  Condition 
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Figure  F-106.  Phase  and  Gain  Margin,  Elevator  Loop,  Filter  Type  G,  Flight  Condition  8 
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Figure  F-107.  Phase  and  Gain  Margin,  Aileron  Loop,  Filter  Type  G,  Flight  Condition  8 
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Figure  F-1 12.  Phase  and  Gain  Margin,  Elevator  Loop,  Filter  Type  H,  Flight  Condition  7 
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Figure  F-1 13.  Phase  and  Gain  Margin,  Aileron  Loop,  Filter  Type  H,  Flight  Condition  7 
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Figure  F-1 14,  Phase  and  Gain  Margin,  Elevator  Loop,  Filter  Type  H,  Flight  Condition  8 
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Figure  F-1 15.  Phase  and  Gain  Margin,  Aileron  Loop,  Filter  Type  H,  Flight  Condition  8 
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F.4.2.3  POWER-SPECTRAL-DENSITY  PLOTS 


Figures  F-116  through  F-131  are  PSD  plots  of  elevator  and  aileron  deflections  and  rates  at 
the  various  flutter  flight  conditions. 
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Figure  F-124.  Power-Spectral-Density  Plot,  Flight  Condition  7 
(Elevator  Displacement) 


Figure  F-125.  Power-Spectral-Density  Plot,  Flight  Condition  7 
(Elevator  Rate) 
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Figure  F-127.  Power-Spectral-Density  Plot,  Flight  Condition  7 
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F-93 


Elevator  displacement,  deg 


Figure  F-128.  Power-Spectral-Density  Plot,  Flight  Condition  8 
(Elevator  Displacement) 
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Figure  F-129.  Power-Spectral-Density  Plot,  Flight  Condition  8 
(Elevator  Rate) 
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Figure  F-130.  Power-Spectral-Density  Plot,  Flight  Condition  8 
(Aileron  Displacement) 


Figure  F-131.  Power-Spectral-Density  Plot,  Flight  Condition  8 
(Aileron  Rate) 
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Incremental  inboard  shear  (normalized  to  open-loop  peak) 


F.4.3  EFFECTS  OF  ACTUATOR  NONLINEARITIES 


F.4.3.1  GUST  RESPONSE  TIME  HISTORIES 

Figures  F-132  through  F-179  show  the  open-  and  closed-loop  discrete  gust  responses  of  the 
following  parameters  for  various  flight  conditions  and  with  linear  and  nonlinear  actuators: 
shear,  torsion,  and  bending  at  various  wing  stations  and  the  corresponding  elevator  and 
aileron  deflections  and  rates. 


Figure  F-132.  Response  of  Inboard  Shear  (rj  - 0.25)  to  a Discrete  (1-cos)  Gust, 
Flight  Condition  1,  Time  History  Simulation 
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Incremental  inboard  bending  moment  (normalized  to  open-loop  peak) 


Figure  F-133.  Response  of  Inboard  Bending  Moment  (rj  = 0.25)  to  a Discrete 
(1-cos)  Gust,  Flight  Condition  1,  Time  History  Simulation 
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Figure  F-135.  Response  of  Outboard  Shear  (n  = 0.75)  to  a Discrete  (1-cos)  Gust, 
Flight  Condition  1,  Time  History  Simulation 
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Figure  F-137.  Response  of  Outboard  Torsion  (rj  = 0.75)  to  a Discrete  (1-cos)  Gust, 
Flight  Condition  1,  Time  History  Simulation 


F-101 


Incremental  elevator  rate,  deg/s  Incremental  elevator  deflection,  deg 


Figure  F-139.  Response  of  Elevator  Rate  to  a Discrete  (1-cos)  Gust, 
Flight  Condition  1,  Time  History  Simulation 
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Figure  F-140.  Response  of  Outboard  Aileron  Deflection  to  a Discrete  (1-cos) 
Gust,  Flight  Condition  1,  Time  History  Simulation 


Figure  F-141.  Response  of  Outboard  Aileron  Rate  to  a Discrete  (1-cos)  Gust, 
Flight  Condition  1,  Time  History  Simulation 
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Figure  F-142.  Response  of  Inboard  Shear  (r\  = 0.25)  to  a Discrete  (1-cos)  Gust, 
Flight  Condition  2,  Time  History  Simulation 


F-104 


Incremental  inboard  bending  moment  (normalized  to  open-loop  peak) 


Gust,  Flight  Condition  2,  Time  History  Simulation 
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Incremental  inboard  torsion  (normalized  to  open-loop  peak) 


Figure  F-144.  Response  of  Inboard  Torsion  (ri  = 0.25)  to  a Discrete  ( 1-cos)  Gust, 
Flight  Condition  2,  Time  History  Simulation 
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Figure  F-145.  Response  of  Outboard  Shear  (rj  = 0.75)  to  a Discrete  (1-cos)  Gust, 
Flight  Condition  2,  Time  History  Simulation 
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Figure  F-146.  Response  of  Outboard  Bending  Moment  (ri  = 0.75}  to  a Discrete 
( 1-cos)  Gust,  Flight  Condition  2,  Time  History  Simulation 
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Figure  F-147.  Response  of  Outboard  Torsion  (ri  = 0.75}  to  a Discrete  (1-cos)  Gust, 
Flight  Condition  2,  Time  History  Simulation 
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Figure  F-148.  Response  of  Elevator  Deflection  to  a Discrete  (1-cos)  Gust, 
Flight  Condition  2,  Time  History  Simulation 


Figure  F- 149.  Response  of  Elevator  Rate  to  a Discrete  (1-cos)  Gust, 
Flight  Condition  2,  Time  History  Simulation 
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Figure  F-150.  Response  of  Outboard  Aileron  Deflection  to  a Discrete  ( 1-cos)Gust, 
Flight  Condition  2,  Time  History  Simulation 
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Figure  F-151.  Response  of  Outboard  Aileron  Rate  to  a Discrete  (1-cos)  Gust, 
Flight  Condition  2,  Time  History  Simulation 
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Figure  F- 152.  Response  of  Inboard  Shear  (-q  = 0.25)  to  a Discrete  ( 1-cos)  Gust, 
Flight  Condition  3,  Time  History  Simulation 
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Figure  F-153.  Response  of  Inboard  Bending  Moment  Ct?  = 0.25)  to  a Discrete  ( 1-cos) 
Gust,  Flight  Condition  3,  Time  History  Simulation 
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Figure  F- 154.  Response  of  Inboard  Torsion  (-q  = 0.25)  to  a Discrete  (1-cos)  Gust, 
Flight  Condition  3,  Time  History  Simulation 
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Figure  F-155.  Response  of  Outboard  Shear  (r]  = 0.75)  to  a Discrete  (1-cos)  Gust, 
Flight  Condition  3,  Time  History  Simulation 
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Figure  F- 156.  Response  of  Outboard  Bending  Moment  lr\  = 0.75)  to  a Discrete  ( 1-cos) 
Gust,  Flight  Condition  3,  Time  History  Simulation 
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Figure  F-157.  Response  of  Outboard  Torsion  (rj  = 0.75)  to  a Discrete  (1-cos)  Gust, 
Flight  Condition  3,  Time  History  Simulation 
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Figure  F- 158.  Response  of  Elevator  Deflection  to  a Discrete  ( 1-cos)  Gust, 
Flight  Condition  3,  Time  History  Simulation 


Figure  F-159.  Response  of  Elevator  Rate  to  a Discrete  ( 1-cos)  Gust, 
Flight  Condition  3,  Time  History  Simulation 
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Figure  F- 160.  Response  of  Outboard  Aileron  Deflection  to  a Discrete  ( 1-cos)  Gust, 
Flight  Condition  3,  Time  History  Simulation 


Figure  F-161.  Response  of  Outboard  Aileron  Rate  to  a Discrete  (1-cos)  Gust, 
Flight  Condition  3,  Time  History  Simulation 
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Incremental  inboard  shear  (normalized  to  open-loop  peak) 


Figure  F- 162.  Response  of  Inboard  Shear  (ri  = 0.25)  to  a Discrete  ( 1-cos)  Gust, 
Flight  Condition  4,  Time  History  Simulation 
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Incremental  inboard  bending  moment  (normalized  to  open-loop  peak) 


Figure  F-163.  Response  of  Inboard  Bending  Moment  (r)  = 0.25)  to  a Discrete  (1-cos) 
Gust,  Flight  Condition  4,  Time  History  Simulation 
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Incremental  inboard  torsion  (normalized  to  open-loop  peak) 


Figure  F-164.  Response  of  Inboard  Torsion  (rj  = 0.25)  to  a Discrete  (1-cos)  Gust, 
Flight  Condition  4,  Time  History  Simulation 
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Figure  F- 165.  Response  of  Outboard  Shear  (rj  = 0.75)  to  a Discrete  ( hcos)  Gust, 
Flight  Condition  4,  Time  History  Simulation 
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Incremental  outboard  bending  moment  (normalized  to  open-loop  peak) 


Figure  F- 166.  Response  of  Outboard  Bending  Moment  (r\  = 0.75)  to  a Discrete 
(1-cos)  Gust,  Flight  Condition  4,  Time  History  Simulation 
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Incremental  outboard  torsion  (normalized  to  open-loop  peak) 


Figure  F- 167.  Response  of  Outboard  Torsion  (rj  = 0.75)  to  a Discrete  (1-cos)  Gust, 
Flight  Condition  4,  Time  History  Simulation 
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Figure  F-169.  Response  of  Elevator  Rate  to  a Discrete  (1-cos)  Gust, 
Flight  Condition  4,  Time  History  Simulation 
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Figure  F- 170.  Response  of  Outboard  Aileron  Deflection  to  a Discrete  ( 1-cos)  Gust, 
Flight  Condition  4,  Time  History  Simulation 


Flight  Condition  4,  Time  History  Simulation 
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Figure  F-172.  Response  of  Elevator  Deflection  to  a Discrete  (1-cos)  Gust, 
Flight  Condition  5,  Time  History  Simulation 


Figure  F- 173.  Response  of  Elevator  Rate  to  a Discrete  ( 1-cos)  Gust, 
Flight  Condition  5,  Time  History  Simulation 
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Figure  F-174,  Response  of  Outboard  Aileron  Deflection  to  a Discrete  (1-cos)  Gust, 
Flight  Condition  5,  Time  History  Simulation 


Figure  F-175.  Response  of  Outboard  Aileron  Rate  to  a Discrete  (1-cos)  Gust, 
Flight  Condition  5,  Time  History  Simulation 
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Figure  F-176.  Response  of  Elevator  Deflection  to  a Discrete  (1-cos)  Gust, 
Flight  Condition  6,  Time  History  Simulation 


Flight  Condition  6,  Time  History  Simulation 
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Figure  F-178.  Response  of  Outboard  Aileron  Deflection  to  a Discrete  (1-cos)  Gust, 
Flight  Condition  6,  Time  History  Simulation 


Figure  F-179.  Response  of  Outboard  Aileron  Rate  to  a Discrete  (1-cos)  Gust, 
Flight  Condition  6,  Time  History  Simulation 
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F.4.3.2  EFFECT  OF  GUST  MAGNITUDE 


Figures  F-180  through  F-195  show  for  various  flight  conditions  the  effects  of  increasing 
gust  magnitude  on  the  wing-load  relief  provided  by  a GLA  system  incorporating  nonlinear 
actuators. 
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Figure  F-181.  Effect  of  Actuator  Nonlinearities  on  Incremental 
Inboard  Torsion  (r}  = 0.25),  Flight  Condition  1 


F-133 


Percent  of  open  loop  -r,  Percent  of  open  loop 


Open  loop 


Closed  loop  (linear  actuator) 


(150) 

I 

(200) 

1 

(250) 

1 

(300) 

1 

50 

1 

60 

1 1 
70  80 

r 

90 

Wind  intensity,  m/s  (ft/s) 

igure  F- 182.  Effect  of  Actuator  Nonlinearities  on  Incremental 

Outboard  Bending  Moment  (r]  = 0.75),  Flight  Condition  1 
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Figure  F- 183.  Effect  of  Actuator  Nonlinearities  on  Incremental 
Outboard  Torsion  (ri  = 0.75),  Flight  Condition  1 
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F-184.  Effect  of  Actuator  Nonlinearities  on  Incremental  Inboard 
Bending  Moment  (rj  = 0.25),  Flight  Condition  2 
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Figure  F- 185.  Effect  of  Actuator  Nonlinearities  on  Incremental  Inboard 
Torsion  (v  = 0.25),  Flight  Condition  2 
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186.  Effect  of  Actuator  Nonlinearities  on  Incremental  Outboard 


Bending  Moment  (r)  = 0.75),  Flight  Condition  2 
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Figure  F-187.  Effect  of  Actuator  Nonlinearities  on  Incremental  Outboaro 
Torsion  (r]  = 0.75),  Flight  Condition  2 
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F-188.  Effect  of  Actuator  Nonlinearities  on  Incremental  inboard 


Bending  Moment  (ri  = 0.25),  Flight  Condition  3 
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Figure  F-189.  Effect  of  Actuator  Nonlinearities  on  Incrementai  inboard 
Torsion  /r?  = 0.25),  Flight  Condition  3 
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Figure  F-190.  Effect  of  Actuator  Nonlinearities  on  Incremental  Outboard 
Bending  Moment  (ri  = 0.75),  Flight  Condition  3 
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Figure  F-191.  Effect  of  Actuator  Nonlinearities  on  Incremental  Outboard 
Torsion  (r\  = 0.75),  Flight  Condition  3 
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Figure  F-192.  Effect  of  Actuator  Nonlinearities  on  Incremental  inboard 
Bending  Moment  (r}  = 0.25),  Flight  Condition  4 
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Figure  F-193.  Effect  of  Actuator  Nonlinearities  on  Incremental  inboard 
Torsion  (r)  = 0.25),  Flight  Condition  4 
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F-194,  Effect  of  Actuator  Nonlinearities  on  Incremental 
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Figure  F-195.  Effect  of  Actuator  Nonlinearities  on  Incremental 
Outboard  Torsion  (r]  = 0.75),  Flight  Condition  4 
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APPENDIX  G:  ALTERNATIVE  IMPLEMENTATION  OF  ACT 


G.1.0  INTRODUCTION 

One  of  the  objectives  of  the  Integrated  Application  of  Active  Controls  (lAAC)  Technology 
to  an  Advanced  Subsonic  Transport  Project  is  the  evaluation  of  the  cost-of-ownership 
advantage  of  Active  Controls  Technology  (ACT)  when  applied  to  an  advanced  subsonic 
transport.  The  purpose  of  the  work,  which  was  conducted  by  Honeywell  Incorporated,  was 
to  assess  the  effect  of  advancing  technology  in  the  electronics  and  automatic  control 
areas  on  these  cost-of-ownership  advantages.  More  specifically,  the  effects  of  the 
technology  advances  associated  with  the  implementation  of  an  ACT  system  that  embodies 
properties  and  characteristics  expected  to  be  available  for  a circa-1990  commercial 
airplane  were  evaluated.  Results  of  this  work  are  reported  in  this  appendix. 

Figure  G-1  shows  the  study  tasks  comprising  the  Advanced  Technology  ACT  System 
definition.  A familiarization  phase  required  for  Honeywell  engineers  involved  in  the 
project  was  followed  by  surveys  of  applicable  technology  developments  and  forecasts  to 
better  identify  elements  appropriate  to  a 1990  operational  system.  The  control  element 
surveys  are  described  in  Section  G.2.0. 

Three  alternative  systems  were  defined:  low  risk,  medium  risk,  and  high  risk. 

Conceptually,  the  low-risk  system  is  similar  to  a 1980  implementation  of  a crucial  control 
function  embodying  conservative  estimates  of  electronic  technology  advances.  The 
medium-risk  system  represents  a significant  step  beyond  current  capability.  The  high-risk 
system  includes  projections  of  standard  computing  elements  that  best  accommodate  the 
existing  failure  state.  These  three  systems  are  detailed  in  Section  G.3.0. 

Alternative  actuation  systems  also  were  studied,  but  the  high-,  medium-,  and  low-risk 
perspective  was  not  followed.  These  actuation  systems  could  be  applied  to  any  one  of  the 
computing  and  sensing  alternatives.  Electromechanical  actuators  were  selected  for 
flaperon  control.  Integrated  hydraulic  actuators,  including  self-contained  servo-loop  and 
bus  interface  electronics,  were  selected  for  the  other  surfaces.  Actuator  studies  are 
described  in  Section  G.^.O. 
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A 1990  ACT  system  was  defined  based  on  the  preceding  work.  Its  qualities  were 
evaluated  with  emphasis  on  those  affecting  cost  of  ownership  to  the  airlines.  Results  of 
this  evaluation  are  defined  in  Section  G.5.0.  Section  G.7.0  contains  conclusions  and 
recommendations. 


Figure  G-1.  Advanced  Technology  ACT  System  Study  Elements 
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G.2.0  1990  CONTROL  TECHNOLOGIES 


Flight  control  element  surveys  were  conducted  to  identify  and  assess  advanced  sensors, 
computing  elements,  and  actuators  appropriate  for  Active  Controls  Technology  (ACT) 
flight  control  implementations  that  will  be  operational  in  1990.  Elements  that  are 
expected  to  be  available  for  the  advanced  ACT  system  implementation  are  identified  in 
this  section. 

Subsection  G.2.1  describes  the  sensor  survey.  Although  improvements  are  expected  in  air 
data  sensors,  the  basic  concept  of  air  data  computers,  which  is  to  service  all  avionic 
subsystems  requiring  air  data,  will  not  change.  Ring  laser  gyros  will  continue  replacing 
mechanical  rate  sensors  to  a greater  extent  because  they  cost  less  and  are  not  subject  to 
mechanical  wear.  Use  of  laser  gyro  rate  signals  implemented  as  separate  outputs  from 
the  inertial  reference  system  (IRS)  is  recommended  for  the  advanced  ACT  system.  Piezo- 
resistive  accelerometers  are  recommended  for  flutter-mode  control  (FMC)  and  wing-load 
alleviation  (WLA)  wing-mounted  accelerometers. 

Subsection  G.2.2  discusses  computer  hardware  advances.  Significant  microcomputer 
advances  are  expected.  Large-scale  integrated  circuit  developments  will  decrease  the 
circuit  card  area  required  and  increase  the  reliability  of  each  function.  Standardization 
of  computer  instruction  sets  will  encourage  use  of  a higher  order  language. 

Actuators  are  discussed  in  Subsection  G.2.3.  It  is  concluded  that  conventional,  cylinder- 
type  hydraulic  actuators  should  be  applied  in  all  instances  except  the  flaperon  control 
surfaces,  where  electromechanical  actuators  (EMA)  are  recommended. 

Subsection  G.2.4  discusses  software  design  and  validation.  Methodologies  will  be  available 
so  that  the  software  can  be  designed  and  validated  for  flight  control  applications  and  so  it 
can  be  certified  to  be  error  free. 
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G.2.1  SENSORS 


Implementation  of  active  control  functions  requires  a number  of  diverse  sensor  types: 

• Air  data  signals  are  required  for: 

• Control  parameter  gain  scheduling 

• Airspeed  feedback  for  pitch-augmented  stability  (PAS) 

• Angle-of-attack  feedback  for  angle-of-attack  limiter  (AAL) 

• Angular  rate  signals  for  PAS  and  lateral/directional-augmented  stability  (LAS) 

• Roll  attitude  signal  for  LAS 

• Accelerometers  for  WLA  and  FMC 

• Position  transducers  for  pilot  control  column,  slat,  and  flap  position  measurement  as 
required  for  fly  by  wire  (FEW),  PAS,  LAS,  and  AAL 

4 

The  element  introduced  by  lAAG  that  has  the  greatest  impact  on  the  choice  of  sensors  is 
the  extreme  reliability  required  for  both  the  crucial  and  critical  functions.  Sensors  must 
be  selected  that  are  highly  reliable,  accurate,  and  dynamically  responsive  while  low  cost. 

Table  G-1  shows  a preliminary  assessment  of  the  sensor  characteristics  required  for 
lAAC.  In  the  following  subsections,  technology  trends  for  each  of  the  required  sensor 
types  are  examined  and  selections  made  for  the  1990  lAAC  system. 

G.2.1. 1 AIR  DATA  PARAMETERS 

The  traditional  method  of  providing  pressure-related  air  data  information  is  to  transmit 
static  and  dynamic  pressures  by  tubing  from  the  pitot  and  static  pressure  probes  to  the  air 
data  computer.  The  accuracy  of  the  outputs  is  dependent  on  the  quality  of  the  pressure 
transducers  and  computers  used  to  develop  the  desired  altitude,  airspeed,  and  Mach 
signals.  Digital  computers  have  become  the  preferred  way  to  compute  air  data  signals 
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Table  G-1.  lAAC  Preliminary  Sensor  Requirements 


Sensor  type 

Sensed  quantity 

Range 

Resolution 

Null  offset 

Bandwidth 

Accelerometer 

Normal  acceleration  at  center 
of  gravity 

WLA 

+4g 

+0.005g 

+0.01  g 

30  Hz 

Vertical  acceleration,  wing 
WLA,  FMC 

+20g 

^0.05g 

+0.01  g 

250  Hz 

Angular  rate 

Pitch-rate  (body) 

+0.01  deg/s 

M 

sensors 

short-period  PAS 

+20  deg/s 

+0.05  deg/s 

Yaw  rate  (body)  LAS 

+20  deg/s 

+0.01  deg/s 

+0.05  deg/s 

Attitude  sensors 

Roll  attitude  LAS 

+45  deg 

0.1  deg 

0.5  deg 

5 Hz 

Air  data 

Indicated  airspeed 

PAS  critical  gain  schedule 

50  to  800  kn 

0.5% 

1% 

0.25  Hz 

PAS  critical  airspeed 

200  to  700  kn 

0.05% 

1% 

1.0  Hz 

WLA  gain  schedule 

100  to  700  kn 

0.5% 

1% 

0.25  Hz 

FMC  gain  schedule 

100  to  700  kn 

0.5% 

1% 

0.25  Hz 

AALgain  schedule 

100  to  400  kn 

0.5% 

1% 

1.0  Hz 

Mach  number 

FMC,  AAL  gain  schedule 
Angle  of  attack 

Oto  1 

0.5% 

1% 

0.25  Hz 

AAL 

+60  deg 

1% 

-■ 

1.0  Hz 

Position 

Column  sensor 

transducers 

Pitch,  FEW,  PAS, 

As 

roll,  LAS 

required 

0.1% 

0.5% 

10  Hz 

Rudder  pedal  sensor 
FEW,  LAS 

0.5% 

1% 

1 Hz 

Slat  position 
AAL 

1% 

1% 

1 Hz 

Flap  position 
AAL,  LAS 

1% 

1% 

1 Hz 

because  the  computations  are  simple,  and  the  capability  to  compensate  the  pressure 
transducers  for  anomalies  is  readily  provided. 


Air  data  systems  that  use  remote  pressure  transducers  located  adjacent  to  the  pitot  static 
parts  are  under  development.  Their  outputs  are  transmitted  electrically  to  computers 
that  develop  the  desired  air  data  signals.  This  is  expected  to  reduce  the  lag  associated 
with  the  sometimes  very  long  lengths  to  tubing.  In  addition,  maintenance  and  cost 
advantages  are  also  expected.  Air  data  parameters  wanted  could  be  processed  in  the  ACT 
computers  if  desired. 
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Angle-of-attack  transducers  currently  in  use  perform  satisfactorily  for  the  AAL  function. 
These  transducer  outputs  are  normally  corrected  for  position  errors  within  the  air  data 
computers. 

As  shown  in  Table  G-1,  it  is  apparent  that  the  air  data  signals  required  for  lAAC  have 
requirements  that  do  not  exceed  the  capabilities  of  digital  air  data  computers  (DADC). 
Also,  triplex  DADCs  provide  redundancy  consistent  with  the  reliability  requirements  for 
the  air  data  signals.  It  is  therefore  recommended  that  the  air  data  signals  required  for 
lAAC  be  obtained  from  the  aircraft  complement  of  DADCs  and  that  this  complement  be 
required  to  be  triplex. 

G.2.1.2  ANGULAR  RATE  SENSORS 

The  main  stabilization  control  loops  in  the  lAAC  pitch  and  yaw  axes  require  highly 
reliable  sources  for  angular  pitch  rate  (q)  and  yaw  rate  (r).  The  pitch-rate  signal  is  part  of 
crucial  PAS  because  without  this  control  loop  the  aircraft  is  unstable  beyond  the  pilot's 
ability  to  control. 

Fundamental  sources  of  angular  rates  have  been  gyroscope-based  measurements.  These 
sensors  require  precisely  spinning  rotors  with  an  angular  displacement  being  observed 
proportional  to  a rate  input  on  an  orthogonal  axis.  Accuracy  has  been  increased  by 
reverse  torquing  the  rotor  back  into  place  and  by  measuring  the  torque-driving  current. 
This  method,  which  has  tightly  confined  spinning  masses,  has  been  prone  to  failure  due  to 
mechanical  wear.  Many  years  of  development  by  numerous  companies,  however,  have 
produced  highly  reliable  devices  accurate  enough  for  flight  control  use. 

Inertial  grade  devices  have  also  evolved  from  the  spinning  rotor  gyroscope.  These  devices 
have  achieved  high  accuracy  at  relatively  high  costs. 

The  advent  of  increased  computer  capabilities  and  the  dynamic  range,  accuracy,  and  high 
reliability  of  the  laser  gyro  have  resulted  in  very  desirable  packages  for  strapdown 
navigation  and  attitude  reference  determination.  Sharing  this  information  with  the  flight 
control  system  is  a natural  outgrowth.  Body  rate  sensors,  therefore,  fell  into  two 
categories:  (1)  strapdown  IRS,  inertial  navigation  system  (INS)  sensors  that  are  shared 

with  the  flight  control  system  and  (2)  dedicated  flight  control  system  sensors. 
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Table  G-2  summarizes  existing  and  emerging  sensor  concepts  for  angular  rate  sensing. 
The  concepts  range  from  the  inertial  grade  strapdown  sensors  likely  to  be  shared  with  the 
flight  control  system  (e.g.,  laser  gyro)  to  low-cost  gyros  that  are  competitive  for 
standalone  flight  control. 

Some  conclusions  that  can  be  drawn  from  Table  G-2  are: 

• The  laser-gyro-based  IRS  system  offers  a very  accurate  source  of  rate  data  if  the 
reliability  and  redundancy  levels  are  sufficient  for  the  crucial  functions. 

• The  nuclear  magnetic  resonance  gyro  offers  great  potential  accuracy  at  low  cost. 
The  probability  of  realizing  this  potential  will  be  studied  later. 

• The  fiber  gyro  is  not  a reasonable  alternative  at  the  current  cost  of  single-mode 
fibers. 

Sharing  IRS  strapdown  body  rate  sensors  and  accelerometers  with  the  flight  control 
system  was  pioneered  with  the  Boeing  767  aircraft.  This  trend  is  likely  to  continue 
because: 

• Accuracy,  requirements  for  flight  control  are  easily  met  by  inertial  grade 
components. 

• Current  IRS  components  (i.e.,  ring  laser  gyros)  have  sufficiently  high  bandwidth  for 
flight  control  applications. 

• Reliability  requirements  of  attitude  reference  dictate  a triple  IRS,  which  is  roughly 
equivalent  to  flight  control  system  reliability  needs.  If  extra  redundant  sensors  are 
needed  for  a given  flight  control  system  axis  reliability  requirement,  low-grade-but 
highly  reliable-flight  control  system  sensors  are  available  at  moderate  costs. 

The  global  positioning  system  (GPS)  may  impact  the  number  of  IRSs  provided  per  aircraft. 
This  very  accurate  position-finding  system  would  allow  a user  to  locate  himself  to  within 
3m  to  6m  (10  to  20  ft)  anywhere  in  the  world.  This  capability  will  have  a profound  effect 
on  navigation  and  could  reduce  the  need  for  INSs.  However,  it  is  still  expected  that  triple 
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Table  G-2.  Angul, 


Sensor/vendor 


►Ring  laser  gyro  Photodiodes 
Honeywell 
(GG  1342) 


• Honeywell 
(GG  1328) 


TRateX 

NnpuP 


• Mirrors 
13) 


Principle 

• Relatavistic  properties  of 
light  result  in  a detectable 
frequency  shift  of  laser 

rs  beam  due  to  motion 

• Mechanical  dither  used 
to  prevent  low-rate 
frequency  lock-in 


-Gas  discharge 


Multioscillator 
gyro  ring  laser 


Reciprocal  anistropic 
(optical  activity)—, 


• Litton 


• Raytheon 


• Avoidance  of  lock-in 
by  beam  bias  using 

a magnetic  field 
on  active  gain  media 

• Elimination  of 
mechanical  dither 


f-*-  Modes 
1 and  4 
Modes  2 and  3 


-Nonreciprocal  anisotropic  (Faraday) 


Dry-tuned  rotor) 


• Litton 


Torsionally  flexible 
coupling 

otor 


Motor  shaft 
(fixed) 


• Motion  normal  to 
spin  axis  causes 
cyclic  gimbal 
oscillation 

* Resulting  gimbal 
reaction  canceled 

by  setting  the  torsion 
spring  constant 


Floated  gyro 


Rotation  axis 


Output 


• Fluid  floated  spin- 
ning momentum  wheel 

• Procession  caused  by 
input  rate  nulled  by 
servo  feedback 

• Torque  generator 
current  is  used  for 
measurement 


I 


Rate  Sensors 


Table  G-2.  Angular  Rate  Sensors  (Continued) 


0 

1 

o 


Sensor/vendor 


Principle 


Range 


Accuracy 


Reliability 

(MTBF) 


Size,  weight, 
power 


Comments 


Nuclear  magnetiq 
resonance  (NMR) 
gyro 

• Litton 

• Singer 


NMR 

cell 


♦ 


Gyro  axis 


(6 

o 

o 

V 

o 

o 

o 

o 

i^^i 

o 

o 

1 1 1 

o 

2) 

-Magnetic 

field 

coils 


• Processional  magnetic 
frequency  of  aligned 
nuclei  is  altered  about 
the  input  axis 

• Shift  small,  but 
measurable 


Strapdown 

capability 


Strap- 

down 

capability 


Very  good 


» 6.4  X 6.4  cm 
(2.5  X 2.5  in) 
diameter 
■ 635g  (1.4  lb) 


Light  input 


ir  ♦ 


Light  detector 


Eapid  warmup 
igh  g environment 
andles  high 
spectrum  of 
requirements 
Available  by  1985 
|*CouId  be  acceler- 
ometer also 


Magnetohydro- 
dynamic gyro 
(MHD) 

• Honeywell 
(GG  2500) 


Spin  axis 


Angular 
accelerometer 
input 
axis 


0 


Rate 
input 
axis  2 


Rate  input  axis  1 


• Spinning  angular 
accelerometer  (torus 
of  liquid  metal)  creates 
a sine  wave  whose 
magnitude  is  a rate 
measurement 

• Two-phase  reference 
input  yields  two-rate 
output 


+360  deg/s 


0.01  deg/s 


Good 
(moving 
parts  not 
demand- 
ing) 


•4.5  x 1.8  cm 
(1.8  X 0.7  in) 
diameter 
•70g  (0.151b) 
•4W 


• Rapid  startup 


Vibrating  wire 
rate  sensor 
(VWRS) 


Pickoffs 
Vibrating  wire 


• Input  rate  causes 
point  deflection  on 
B-C  path  detectable 
by  signal  magnet 


+300  deg/s 


0.1  deg/s 


50K  hr 


Signal 
magnet 

Drive 

magnet 


•5.1  X 3.0  x 
2.8  cm 
(2.0  X 1.2  X 
1.1  in) 

'lOOg  (0.22  lb) 
'Low  power 


Fiber  optic  laser 
gyro 


fiber  wrap 


1 km  (3280  ft) « Interferemetrically 
Single-mode  sensed  laser  phase 
shift 

» Detector  technology 
requires  1-km  (3280-ft) 
single-mode  fiber  for 
output  resolution 


+400  deg/s 


0.01  deg/s 


Very  good 
(greater 
than  ring 
laser  gyro) 


• Size  as  per 
figure 

• 2.5  cm  (1  in) 
thick 


• Price  depends 
upon  cost  of 
single-mode 
fibers 


O-HEIectroni^ 

Detector 


IRSs  will  be  provided  for  transport  aircraft  in  1990  because  of  the  need  for  highly  reliable 
attitude  and  heading  reference  signals. 

To  achieve  high  performance  at  low  cost,  it  is  concluded  that  the  available  IRS  angular 
rate  signals  should  be  used  for  lAAC  to  the  greatest  extent  possible. 

G.2.1.3  ACCELEROMETERS 

As  shown  in  Table  G-1,  acceleration  data  are  required  for  WLA  modes;  i.e.,  gust  load, 
maneuver-load  control  (MLC),  and  FMC  systems.  Accelerations  also  can  be  used  when 
analytical  redundancy  and  state  reconstruction  for  reversion  modes  are  considered. 

Because  MLC  requires  an  acceleration  signal  measured  at  the  center  of  gravity  (eg), 
acceleration  sharing  with  the  IRS  system  is  used.  Table  G-3  contains  accelerometer 
concepts  ranging  from  inertial  grade  sensors,  suitable  for  the  IRS  and  MLC,  to  structural 
mode  control  sensors  suitable  for  FMC  and  gust-load  alleviation  (GLA)  applications. 

The  order  (table  G-3)  is  determined  by  an  accuracy  parameter  that  is  the  ratio  of  the 
given  device's  maximum  range  to  its  resolution.  Inertial  grade  requirements  are  typically 
range  and  resolution  of  10  to  10  , while  flight  control  system  requirements  are  10  to 
lo'^. 

Further  trends  in  accelerometers  are  summarized  as  follows: 

• Inertial  grade  accelerometer  costs  are  going  down,  providing  IRS-INS  and  shared 
flight  control  system  functions  with  low-cost  derivations.  Extra  redundancy  for 
higher  reliability  of  functions  is  very  desirable  with  such  devices. 

• Piezo-resistive  concepts  show  promise,  particularly  for  low-cost,  highly  reliable 
structural  control  systems,  and  are  recommended  for  the  WLA  and  FMC  wing- 
mounted  acceleration  packages  for  lAAC. 

• New  concepts  appear  to  be  either  too  undeveloped  for  useful  evaluation  (e.g., 
passive  magnetic  suspension)  or  have  no  identified  benefit  for  shared  INS  and  flight 
control  system  functions  (e.g.,  laser  accelerometer). 


G-10 


G-11 


IRS-INS  capability 
at  low  cost 


o 


Table  G-3.  Accelerometer  Concepts  (Continued) 


G.2.2  AIRBORNE  COMPUTER  TECHNOLOGY 


The  adoption  of  standards  will  have  a positive  impact  on  avionic  systems  because  of  the 
enormous  support  standardization  will  bring  to  software  development.  The  trend  to 
standard  instruction  sets  is  discussed  in  Subsection  G.2.2. 1.  In  Subsection  G.2.2.2,  current 
avionic  computers  are  reviewed— especially  the  HDP-5301.  The  input/output  (I/O) 
structures  of  microcomputer  systems  are  included  to  show  the  need  for  chips  supporting 
the  microprocessor;  the  8086  family  is  used  as  an  example.  The  design  of  a general- 
purpose  computer  expected  by  the  mid-1980s  using  very-large-scale  integrated,  very-high- 
speed  integrated  circuits  (VLSI/VHSIC)  is  examined  in  detail.  Speed  and  flexibility  are 
found  to  be  greater  than  that  needed  for  flight  control  calculations.  The  complicated 
software  now  used  for  self-monitoring  and  cross-channel  voting  will  be  replaced  by 
hardware  functions  to  make  the  software  computational  load  light.  Figure  G-2  shows  the 
projection  of  avionic  computing  needs;  the  curve  extrapolates  to  1.5M  operations  per 
second  (ops)  in  1990.  This  is  light  when  compared  to  the  5M  to  6M  ops  expected  to  be 
available  for  mid-1980  microcomputer  systems.  Bus  issues  will  be  the  limiting  factors  in 
avionic  systems  as  the  central  computing  structures  become  routine.  Fiber  optics  will 
become  important  communication  components.  Although  current  costs  and  coupling 
techniques  are  not  acceptable,  they  will  change. 

G.2.2. 1 STANDARD  INSTRUCTION  SET  TREND 

The  U.5.  Department  of  Defense  and  NASA  have  developed  programs  for  standardizing 
certain  characteristics  of  embedded  computers.  The  objective  is  to  establish  a standard 
instruction  set  so  that  a compiler  can  operate  independent  of  the  particular  machine  being 
used.  Software  engineers,  for  example,  can  work  with  any  of  the  standardized  digital 
processors  without  learning  the  peculiarities  of  the  different  machines. 

A standard  higher  order  language  that  is  a step  toward  reducing  software  costs  and 
improving  software  understanding  is  another  objective. 

One  program  directed  toward  standardization  is  the  U.S.  Air  Force's  MIL-STD-1750 
instruction  set.  There  have  been  several  evaluations  of  the  1750,  and,  as  a result,  the 
program  was  revised  to  the  current  1750A  instruction  set,  which  is  described  in  the 
following  paragraph.  (Reference  G-1  is  one  evaluation  of  the  set.) 


G-13 


Figure  G-2.  Throughput  of  Honeywell  Computers  Used  in  Avionic  Division 
Products 

The  standard  defines  a general-purpose  computer  architecture  as  seen  by  a programmer 
writing  in  machine  language.  It  prescribes  data  and  instruction  formats  and  computer 
organization  and  operation  enabling  establishment  of  standard  software  development 
resources.  In  addition  to  its  benefit  to  support  software,  such  as  compilers  and 
instruction-level  simulators,  the  1750A  is  expected  to  make  software  development  mainly 
independent  of  hardware  development.  The  features  of  the  1750 A instruction  set  are 
summarized  in  the  following  list: 

• 16-bit  structure  (registers,  memory  addressing,  instruction  size) 

• 16  general  registers  (16  bits) 

• Three  registers  usable  as  base  registers 

• Good  range  of  address  modes: 

• Immediate 

• Register 

• Memory  direct 

• Memory  indirect 

• Base  relative 
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• Wide  range  of  operand  types: 

• Bit 

• Byte 

• Fixed  (16) 

• Double  fixed  (32) 

• Floating  (32) 

• Extended  floating  (48) 

• Expanded  memory  addressing  (optional); 

• Virtual  to  physical  mapping,  to  IM  words 

• Block  protect 

• Interrupts,  16  levels,  priority,  vectored 

• I/O,  control  of  I/O  interrupts,  times  (via  two  commands) 

Four  implementations  have  been  built,  and  at  least  13  computer  manufacturers  are 
developing  1750-based  computers.  Most  of  the  implementations  are  bipolar  bit-sliced 
designs,  but  other  approaches  are  possible.  Low-power  integrated  injection  logic  (I  L) 
technology  using  gate  arrays  or  radiation-hard  complementary  metal-oxide  semi- 
conductcr/silicone  on  sapphire  (CMOS/SOS)  has  been  considered.  It  may  be  possible  to 
change  the  microprogram  of  a current  16-bit,  single-chip  microprocessor  to  incorporate 
most  of  the  1750A  features.  An  example  of  a VLSI/VHSIC  chip  set  is  discussed  later  in 
this  section.  In  the  example,  a very  general  capability  is  sought  to  make  the  architecture 
fit  other  standards  in  addition  to  1750A.  These  ask  for  a 32-bit  structure  that  causes 
some  inefficiencies  when  restricted  to  the  16  bits  of  1750A. 

G.2.2.2  CURRENT  AVIONIC  COMPUTERS 

Most  of  the  computers  used  in  the  flight  control  systems  are  constructed  with  the  2900 
family  of  bipolar  components  to  form  a microprogrammed  bit-sliced  architecture.  This 
approach  provides  a very  flexible  method  for  the  design  of  high-performance 
microcomputers. 

In  the  following  subsections,  the  bit-slice  designs  and  chips  are  reviewed,  and  the 
architecture  of  the  HDP-5301,  which  is  typical  of  current  avionic  computer  designs,  is 
outlined. 
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G.2.2.2.1  Bit-Slice  Architecture 


Bit-slicing  is  the  construction  of  a processor  with  several  building  blocks,  each  having 
data  paths  of  a few  bits.  A usual  construction  is  to  use  four  4-bit  microprocessors  to 
produce  a 16-bit  architecture.  Bipolar  circuits  are  fast  but  draw  substantial  power.  One 
reason  for  bit-slicing  was  that  too  much  heat  would  be  generated  in  a single  16-bit 
processor  package.  However,  with  the  newer  technologies,  this  is  no  longer  an  important 
factor. 

The  2900  series  is  a family  of  low-power  Schottky  transistor-transistor  logic  (TTL) 
building  blocks  for  high-performance  applications.  A wide  vaHety  of  instruction  sets  or 
logical  designs  may  be  implemented;  the  user  is  not  limited  to  a single,  fixed  instruction 
set  as  in  the  whole-chip,  8-  and  16-bit  microprocessors.  The  building  blocks  are  relatively 
low  level  to  provide  for  flexible  designs.  This  results  in  a high  chip  count  compared  to 
metal-oxide  semiconductor  (MOS)  microprocessor  systems.  The  HDP-5301  requires  42 
chips. 

A generalized  computer  architecture  is  shown  in  Figure  G-3.  Each  of  the  blocks  can  be 
constructed  from  members  of  the  2900  family.  Reference  G-2  shows  how  the  design  can 
be  made  to  meet  throughput  requirements  and  to  execute  special  algorithms. 

G.2.2.2.2  Example  of  a Current  Avionic  Computer 

The  HDP-5301  is  a bit-slice  design  using  the  2900  family.  This  processor  comes  on  a 
single  printed  circuit  board  15.9  by  16.5  cm  (6.25  by  6.50  in).  It  is  lightweight,  0.34  kg 
(12  oz),  consumes  12. 5W,  and  needs  one  +5V  power  source.  Instructions  are  rapidly 
executed  by  interleaving  the  fetch  and  execution  cycles.  In  summary,  the  HDP-5301 
features  are: 

• Bipolar  microprocessor  using  Schottky  circuitry 

• Expandable  instruction  and  data  memory  up  to  64K  words 

• 16-bit  instruction  word  length 

• Data  word  length  of: 

• 16  bit,  single  precision,  fixed  point 

• 32  bit,  double  precision,  fixed  point 
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• Floating  point,  with  32-bit  mantissa,  and  16-bit  exponent  in  extended 
capability  option 

• Minimum  execution  times  of: 

• 0.6-fis  clear 

• 1.0-pts  add/subtract 

• 6.2-/IS  multiply 

• IS.S-MS  divide 

• Priority  interrupt  with  vectoring  to  16  locations 

• Power  recovery  interrupt 

• 16-bit  parallel  direct  input  and  direct  output  channels 

• Direct  memory  access  (DMA)  capability 

Figure  G-^  shows  the  organization  of  the  processor.  The  register/arithmetic  logic  unit  is 
constructed  of  four  slices,  each  4 bits  wide,  cascaded  to  provide  16-bit  arithmetic  and 
logic  operations.  It  contains  a 16-word,  two-port  register  file  and  a single  register  for 


Interrupt  requests 

To  interface  controllers 

Figure  G-3.  Generalized  Computer  Architecture 
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extended  arithmetic  and  logic  operations.  For  double  precision  operation,  data  words  are 
held  in  the  concatenated  A and  B registers.  The  file  and  special  registers  perform  the 
following  conventional  functions: 

• Six  temporary  registers  for  microprograms 

• Program  counter 

• Base  save  register 

• A register 

• B register 

• E (exponent)  register 

• X (index)  register 
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Figure  G-4.  Organization  of  the  HOP -5301  Processor  Unit 
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• Base  register 

• Alternate  base  register 

• Stack  point 

• Mode  register 

The  programmer  has  access  to  all  but  the  first  three  of  these  registers.  Definitions  of 

items  in  Figure  G-^  are: 

• Memory  address  register— a 16-bit  register  that  provides  the  address  of  either 
instructions  or  data  to  the  memory. 

• Input  holding  register— a 16-bit  latch  register  that  holds  the  fetched  instruction  or 
data. 

• Microsequence  selector— a read-only  memory  (ROM)  addressed  by  the  instruction 
operation  code  bits  to  determine  the  starting  location  of  the  microprogram  to  be 
executed;  ROM  output  is  fed  into  the  microprogram  sequence  counter  as  an  initial 
condition. 

• Microprogram  sequence  counter-addresses  the  microprogram  control  memory  to 

derive  the  control  signals  and  other  functional  elements  of  the  central  processing 
unit  (CPU). 

• Microprogram  control  memory— an  ROM  addressed  by  the  microprogram  sequence 
counter  to  determine  the  control  signals  and  other  functional  elements  of  the  CPU. 

• Mode  latch-a  register  that  determines  the  mode  of  operation  of  the  processor  (i.e., 
single  or  double  precision,  fixed  or  floating  point,  etc.). 

• Status  multiplexer  (MUX)— selects  the  individual  discretes  and  modes  of  the  CPU. 

• Data  mask-a  latch  used  to  introduce  constants  into  the  microprocessor  from  the 
microprogram  control  memory. 

• Data  input  bus-contains  16  lines  that  transmit  data  from  the  memory  and  the  I/O  to 
the  CPU. 
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• Data  input  bus— contains  16  lines  that  transmit  data  from  the  CPU  to  the  memory 
and  the  I/O. 

• Address  bus— contains  16  lines  that  specify  the  memory  location  to  be  accessed  for 
instruction  fetch  or  data  transfer  or  the  I/O  device  to  be  accessed  for  data  transfer. 

• Discrete  output  latch— has  eight  outputs  that  are  controlled  by  the  microprogram 
control  memory. 

The  processor  may  be  used  with  a variety  of  memories;  however,  the  selection  may 
influence  the  processor  cycle  time.  The  minimum  cycle  time  of  the  processor  is  200  ns. 
The  basic  memory  reference  instruction  requires  five  processor  cycles  for  a minimum 
instruction  time  of  1 /is.  For  the  CPU  to  operate  at  maximum  speed,  memory  access  time 
must  be  less  than  250  ns,  and  the  memory  cycle  time  must  be  less  than  ^00  ns  for  both 
instructions  and  data.  The  clock  must  be  slowed  down  when  it  is  used  with  memories  with 
longer  cycle  times. 

Words  are  classified  according  to  the  following  scheme: 

• Instruction  words: 

• Memory  references  or  control  transfers 

• I/O  instructions 

• Generic  instructions 

• Data  words: 

• Single  precision,  fixed  point 

• Double  precision,  fixed  point 

• Double  precision,  floating  point 

The  formats  of  these  words  are  conventional. 

The  addressing  structure  allows  relative,  indexed,  and  indirect  modes  to  be  used  for 
memory  reference  and  control  transfer  instructions.  There  are  no  memory  banks  or  pages 
for  either  instruction  or  data  memory.  One  of  the  registers  of  the  register  file  is  used  as 
a base  register.  The  displacement  field  of  the  memory  reference  instruction  is  a signed 
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integer  offset  of  the  desired  memory  location  relative  to  the  base  address  held  in  the  base 
register.  The  inactive  base  register  is  provided  to  facilitate  operations  with  two  or  more 
base  address  values.  The  two  base  values  may  be  interchanged  to  ease  handling  when 
more  than  IK  of  data  words  are  required.  The  base  register  is  cleared  at  power  "on";  the 
inactive  base  register  is  not  cleared  at  power  "on."  Indirect  addressing  is  also  provided, 
permitting  access  of  addresses  beyond  the  active  base  register  range.  Pseudo-indexing  is 
available  in  addition  to  true  indexing.  Control  transfer  addressing  is  similar  to  memory 
reference  addressing,  except  that  the  displacement  field  refers  to  an  address  relative  to 
the  current  contents  of  the  program  counter  rather  than  the  base  register.  The  base 
register  is  used  in  the  indirect  jump  mode  to  fetch  the  address  that  is  the  location  of  the 
next  instruction. 

The  instruction  set  is  microprogrammed.  It  may  be  altered  and  new  instructions  may  be 
added  for  special  purposes.  The  instructions  are  grouped  as: 

• Load  and  store 

• Arithmetic 

• Control 

• Logical 

• Shift 

• Transfer  control 

• Input/output 

One  clock  cycle  is  required  for  the  execution  of  a single  microinstruction  step.  The 
minimum  cycle  is  200  ns,  corresponding  to  a primary  clock  frequency  of  5 MHz.  Indexing 
requires  one  additional  machine  cycle;  indirect  addressing  requires  two  additional  machine 
cycles. 

A comparison  of  the  HDP-5301  with  similar  computers  is  made  in  Table  G-4.  All 
computers  have  a 16-bit  word  length,  provide  double  precision  arithmetic  operations, 
access  6^K  of  memory,  have  16  interrupts,  and  claim  a reliability  of  more  than  1500  hr. 
These  computers  were  designed  in  the  early  1970s.  Although  they  appear  to  be  similar 
machines,  there  are  many  differences. 
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Table  G-4.  Comparison  of  Avionic  Computers 


Instruction 

mix, 

percent 

Instruction  time,  jus 

Instruction  mix 

Rolm 

1664 

Delco 
362  F 

SKC 

3100 

IBM 

ML-1 

TD 

43S 

SKC 

2516 

HDP- 

5301 

Fixed  point 
Load 

10.0 

2.0 

2.5 

1.92 

2.7 

2.25 

0.95 

m 

Store 

10.9 

2.0 

2.5 

1.92 

3.4 

2.25 

0.95 

Add/subtract 

4.0 

1.0 

2.5 

1.92 

1.9 

2.25 

0.95 

Multiply 

0.5 

5.6 

4.75 

8.16 

4.3 

6.75 

1.95 

Divide 

— 

12.6 

9.0 

13.76 

6.3 

- 

7.75 

m 

Floating  point 
Load 

11.7 

4.6 

3.75 

2.88 

2.7 

3.25 

1.45 

1.6 

Store 

12.8 

5.3 

3.75 

2.88 

3.6 

3.25 

1.45 

2.0 

Add/subtract 

4.7 

1.9 

9.8 

14.0 

4.7 

4.0 

4.0 

7.6 

Multiply 

4.5 

2.2 

7.0 

26.0 

11.4 

4.0 

9.4 

12.0 

Divide 

0.2 

2.6 

12.0 

100.0 

19.4 

10.0 

50.0 

25.0 

Shift 

4.6 

3.5 

3.0 

4.5 

3.2 

3.0 

2.7 

4.2 

Logical 

4.6 

1.2 

3.0 

1.92 

3.0 

2.25 

0.95 

1.0 

Test/branch 

30.5 

2.3 

2.5 

2.1 

1.4 

1.75 

1.15 

0.8 

I/O  control 

1.0 

1.8 

2.5 

4.16 

2.0 

1.0 

1.7 

2.0 

Throughput  (K  ops) 

353 

293 

236 

390 

541 

456 

G.2.2.2.3  Computer  Design  Based  on  a Single-Chip  Microprocessor 

The  new  16-bit,  single-chip  microprocessors,  in  particular  the  8086,  the  68000,  the  Z8000, 
and  the  9900,  bring  enough  capacity  to  be  the  basis  of  the  design  of  avionic  computers. 
General  Dynamics  has  developed  a 350K  ops  airborne  computer  using  the  Z8002 
microprocessor.  Honeywell  is  using  the  8086  for  several  avionic  advanced  development 
projects,  including  the  NASA  Demonstration  Advanced  Avionics  System  and  the  AFFDL 
Multimicroprocessor  Flight  Control  System.  The  former  is  a multicomputer  package  for 
general  aviation  aircraft;  the  latter  is  a highly  redundant  experimental  configuration. 
Environmental  requirements  of  temperature  and  radiation  are  a major  concern  in 
development  of  the  machines.  The  new  microprocessors  are  targeted  for  the  commercial 
market.  It  may  be  some  time  before  versions  with  full  environmental  capability  for 
aircraft  are  available. 
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G.2.2.2A  Current  Chip  Families 


The  introduction  of  new  microprocessor  chips  into  the  market  has  reached  a plateau  (ref 
G-3).  Although  there  have,  been  no  major  new  families  to  add  to  the  Electronic  Design 

News  (EDN)  chip  directory,  there  have  been  additions  and  refinements  to  the  established 
families.  The  position  of  the  EDN  editor  is  that  these  families  will  remain  the  choices  of 
designers  in  the  1980s  because  of  the  advantages  of  dealing  with  one  instruction  set,  one 
hardware  architecture,  one  bus  structure,  and  one  development  system.  Further,  the 
software  support  accumulates  to  produce  a momentum  that  is  hard  to  abandon. 
Development  of  chips  to  augment  the  families  has  been  predictable  (ref  G-^f).  These 
views  are  heavily  influenced  by  the  commercial  market  that  is  finding  the  present 
families  suitable  for  their  products.  The  development  of  ruggedized  versions  lags  behind 
the  commercial  introductions  by  2 or  3 years.  One  of  the  objectives  of  the  VHSIC 
program  is  to  redress  this  situation.  As  the  VLSI  and  VHSIC  technologies  mature,  there 
will  be  a new  surge  of  innovations. 

G.2.2.2.5  Input/Output  Methods 

In  some  computer  architectures,  the  memory  has  two  interfaces:  the  first  to  the 
processor,  the  second  to  the  I/O  peripherals.  The  processor  has  separate  instructions  for 
memory  reference  and  for  I/O  operations.  This  arrangement  is  called  a data  channel  I/O. 
In  other  architectures,  the  data  transfer  registers  of  all  devices  are  considered  as 
locations  in  memory  with  assigned  addresses.  No  separate  output  channel  is  designated, 
nor  are  any  special  I/O  instructions  necessary.  This  is  called  a memory-mapped  I/O. 
Often  in  the  data  channel  architecture,  instead  of  a separate  I/O  bus  and  a device 
selection  bus,  part  of  the  address  bus  is  used  as  the  device  selecting  lines;  the  data  are 
delivered  on  the  data  bus.  There  is  an  I/O  request  line  controlled  by  the  microprocessor 
that  determines  that  the  data  and  address  buses  are  either  acting  as  a data  channel  or 
that  they  are  acting  as  a memory  reference.  The  processor  has  a set  of  instructions  to 
read  or  write  to  the  I/O  ports. 

Peripheral  devices  can  send  and  receive  data  at  limited  rates.  A method  is  needed  to 
determine  when  to  make  data  transfers.  In  the  approach  called  polling,  the 
microprocessor  periodically  examines  status  registers  of  the  input  devices  to  determine  if 
new  data  are  ready  on  any  of  them.  Another  approach,  called  interrupt-driven  I/O,  uses 
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an  interrupt  to  tell  the  processor  that  new  data  are  ready.  If  there  are  multiple  interrupt 
lines,  the  processor  knows  which  device  is  ready.  If  there  is  only  one  interrupt  line,  the 
processor  must  have  a polling  routine  to  determine  the  source  of  the  data.  Polled  I/O 
initialization  uses  simple  hardware,  but  it  requires  more  processing  time  than  the 
interrupt-driven  methods. 

Some  systems  allow  a peripheral  device  to  take  control  of  the  computer  bus  to  transfer 
data  into  and  out  of  the  memory  directly  without  the  intervention  of  the  processor;  this  is 
called  direct  memory  access.  The  approach  provides  high  transfer  rates  and  reduces 
processing  time.  There  are  several  methods  for  removing  the  processor  from  the  bus 
during  the  DMA  cycle.  The  simplest  way— and  the  usual  method  in  microcomputer 
systems— is  to  stop  the  processor  and  float  its  address,  data,  and  control  lines.  A request 
line  is  available  to  the  DMA  devices  that  causes  the  microprocessor  to  go  into  an  idle 
state  as  soon  as  it  completes  its  current  instruction.  When  this  is  done,  a bus  acknowledge 
signal  is  sent  back  to  the  peripheral  to  show  that  the  bus  is  ready  for  the  DMA  transfer. 
This  process  is  referred  to  as  cycle  stealing,  because  the  clock  cycles  used  for  the  DMA 
transfer  are  stolen  from  the  processor  that  otherwise  would  do  useful  manipulations.  To 
avoid  losing  processing  time,  an  interleaved  method  is  sometimes  used.  The  DMA  takes 
control  of  the  bus  when  the  processor  is  not  using  it.  If  the  processor  has  a queue  of 
instructions,  it  can  continue  its  operation  during  the  DMA  transfer  without  significant 
interruption. 

Microprocessors  are  sometimes  classified  as  register  oriented  or  memory  oriented,  or 
whether  they  are  designed  for  simple  controlling  tasks  or  have  more  complicated 
instruction  sets  for  arithmetic  computations.  The  8086  is  an  example  of  a 
microprocessor.  It  is  a 16-bit,  two-address  machine  using  the  high-performance  metal- 
oxide  semiconductor  (HMOS)  technology.  The  processor  chip  contains  29  000  transistors 
and  runs  on  a single  5V  power  supply  at  a clock  rate  of  5 or  8 MHz.  The  8086  can  perform 
arithmetic  operations  on  signed  and  unsigned  8-  and  16-bit  binary  integers  as  well  as 
provide  correction  operators  for  arithmetic  on  packed  and  unpacked  decimal  integers. 
The  usual  logic  operations  and  intramodule  and  intermodule  transfers  of  control  are 
provided.  Six  primitive  string  operations  and  specialized  control  operators  for  building 
arbitrarily  complex  functions  are  included. 
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A large  family  of  processors  and  supporting  chips  are  offered.  The  8086  is  the  general 
data  processor,  the  8089  is  the  I/O  processor,  and  the  8087  is  the  numerical  data  processor 
(NDP).  An  8289  bus  arbiter  chip  manages  bus  contention  in  a multiprocessing  system. 
Other  support  elements  are; 

8282/83  octal  latches 
8286/87  octal  transceivers 
8284  clock  generator 
8288  bus  controller 
8259A  interrupt  controller 

8291  general-purpose  interface  bus  (GPIB)  talker/listener 

8292  GPIB  controller 

8237-2  programmable  DMA  controller 

UPI-41A  universal  peripheral  interface 

8202  dynamic  random-access  memory  (RAM)  controller 

8231  arithmetic  processing  unit 

8232  floating  point  processor 

8251 A universal  synchronous/asynchronous  receiver/transmitter  (USART) 

8253-3  programmable  interval  timer 
8255A-5  programmable  perhipheral  interface 
Other  peripheral  device  chips 

The  8089  I/O  processor  improves  the  computational  efficiency  of  the  system  processor  by 
removing  the  I/O  tasks  from  the  CPU  and  provides  the  capabilities  for  DMA.  The  CPU 
performs  an  I/O  operation  by  building  a message  in  memory  that  describes  the  function. 
The  I/O  reads  the  message,  performs  the  function,  and  then  informs  the  CPU  that  the  task 
has  been  completed.  All  I/O  devices  appear  to  the  CPU  as  transmitting  and  receiving 
whole  blocks  of  data.  The  I/O  processor  assumes  all  device  controller  overhead,  performs 
both  programmed  and  DMA  transfers,  and  covers  "soft"  I/O  error  without  CPU 
intervention.  The  CPU  is  left  to  do  the  computation. 

The  8087  NDP  implements  the  Institute  of  Electrical  and  Electronics  Engineers  (IEEE) 
floating-point  standard  and  handles  single-  and  double-precision  formats,  double-extended 
format,  rounding  control,  infinity  control,  and  the  associated  required  instructions.  An 
escape  instruction  in  a sequence  of  8086  operations  activates  the  8087  NDP  coprocessor 
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and  makes  the  8086  perform  a read-to  memory.  The  CPU  ignores  the  returned  data. 
Concurrently,  a 6-bit  operation  code  in  the  escape  command  tells  the  coprocessor  what 
operation  to  perform.  The  coprocessor  accepts  the  data  brought  by  the  8086  and  uses  it 
as  either  data  or  as  a pointer  to  the  start  of  the  data.  The  coprocessor  has  temporary 
control  of  the  data  and  address  buses  for  retrieving  and  storing  data  and  results.  To  the 
programmer,  the  combined  8086  and  8087  appear  as  a single  machine.  The  8087  adds 
seven  data  types  and  eight  registers  to  the  basic  machine. 

The  GPIB  family  performs  all  the  bus  functions  required  by  the  IEEE  488  Standard.  This 
allows  transfers  between  microprocessors,  peripherals,  and  instruments  from  various 
manufacturers.  The  8291  is  a microprocessor-controlled  chip  that  interfaces  a variety  of 
microprocessors,  including  the  8086  family.  In  addition  to  its  ability  to  interface  both 
8-  and  16-bit  microcomputers  to  the  GPIB,  the  talker /listener  provides  a complete  source 
and  acceptor  handshake  and  complete  talker/listener  functions  with  extended  addressing. 
It  can  operate  in  a clock  range  from  1 to  8 MHz.  The  8292  controls  the  bus  using  three 
bus  lockup  timers  to  detect  any  major  problems  on  the  GPIB  bus.  The  8293  is  a 
bidirectional  transceiver  that  can  be  hardwired  to  one  of  four  modes  of  operation  to 
support  a talker /listener  environment. 

The  device  also  can  be  used  as  a general-purpose  push-pull  or  open-collector  bus 
transceiver  with  nine  receiver/drivers. , The  three  components  form  a complete  IEEE-488 
talker/listener/controller  bus  interface  for  a microprocessor.  The  electric  interface  is 
performed  by  transceivers,  data  transfers  by  the  8291,  and  control  of  the  bus  by  the  8292. 

The  8237-2  DMA  controller  provides  microcomputer  peripherals  for  8086-based  systems 
with  a direct  link  to  system  memory.  The  5-MHz  DMA  controller  operates  at 
1.6  megabytes  per  second.  This  transfer  rate  allows  an  8086-based  system  to  interface  to 
hard  disks,  serial  communcation  links,  and  high-speed  parallel  links.  Less  CPU  time  is 
spent  in  the  idle  state  while  data  are  being  transferred  to  the  bus,  which  improves  the 
overall  system  throughput.  This  is  an  advantage  in  systems  performing  cathode-ray-tube 
(CRT)  refresh  and  dynamic  RAM  refresh.  Applications  for  the  DMA  controller  include 
disk  control  telecommunications,  GPIB  interfaces,  and  high-speed  scanning  or  "frame- 
grabbing" types  of  operations. 
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The  UPI-41A  8-bit  microcomputer  is  a general-purpose,  programmable  interface  device 
that  functions  as  a peripheral  controller.  It  contains  a microcomputer  with  program 
memory;  data  memory;  and  8-bit  CPU,  I/O  ports,  time/counter,  and  clock.  As  a complete 
microcomputer,  the  device  provides  more  flexibility  for  the  designer  than  conventional 
large-scale  integrated  interface  devices.  The  UPI-41A  is  an  efficient  controller  as  well  as 
an  arithmetic  processor.  Basic  applications  include  keyboard  scanning,  printer  control, 
display  multiplexing,  and  similar  functions  that  involve  interfacing  peripheral  devices  to 
microprocessor  systems. 

The  8202  dynamic  RAM  controller  can  directly  address,  refresh,  and  drive  up  to  64K  bytes 
of  RAM  memory  without  buffering.  Also,  the  single-chip  controller  provides  on-chip,  all- 
multiplexed  addresses  and  address  strobes,  automatic  asynchronous  refresh/address 
arbitration,  and  system-acknowledge  and  transfer-acknowledge  signals.  A refresh  timer 
and  refresh  counter  are  provided.  The  refresh  requests  are  generated  either  internally  or 
externally.  The  external  refresh  request  offers  users  a transparent  capability. 

Other  standard  peripherals  compatible  with  the  8086  family  of  processors  include  an 
arithmetic  processing  unit, , a programmable  interval  timer,  and  a variety  of  controllers 
and  interface  devices.  The  8231  arithmetic  processing  unit  provides  high-performance 
fixed-  and  floating-point  arithmetic  and  floating-point  trigonometric  operations  and  may 
be  used  in  lieu  of  the  8087  coprocessor.  Chebyshev  polynominals  are  used  in  the 
implementation  of  arithmetic  algorithms.  This  unit  may  be  used  to  compute  square  roots, 
logarithms,  and  exponentials.  It  allows  float-to-fixed  and  fixed-to-float  conversions  and 
offers  both  trigonometric  and  inverse  trigonometric  functions.  The  8232  floating-point 
processor  handles  32-  and  64-bit  precision  addition,  subtraction,  multiplication,  and 
division  operations. 

The  8251 A programmable  communication  interface  is  an  enhanced  USART  designed  for 
data  communications.  The  8251 A is  used  as  a peripheral  device  and  is  programmed  by  the 
CPU  to  operate  using  virtually  any  serial  data  stream  for  serial  transmission.  It  can 
simultaneously  receive  serial  data  streams  and  convert  them  into  parallel  data  characters 
for  the  CPU.  The  8253-5  is  a programmable  interval/timer  chip  for  use  as  a 
microcomputer  peripheral.  It  is  organized  as  three  independent  16-bit  counters;  all  modes 
of  operation  are  software  programmable.  The  8255-5  programmable  peripheral  interface 
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is  a general  programmable  I/O  device  that  contains  2k  programmable  I/O  pins  that  can  be 
individually  programmed  in  two  groups  of  12  and  be  used  in  three  modes  of  operation  for 
flexible  I/O  design. 

Note  that  there  is  a very  extensive  set  of  chips  from  which  the  system  designer  may 
construct  a computer  suited  to  specific  needs.  The  advantages  of  this  set  are  mainly  due 
to  the  need  of  I/O  interfaces  to  a large  variety  of  peripheral  equipment.  Implementation 
in  larger  scale  integration  is  discussed  in  the  following  paragraphs. 

G.2.2.2.6  Future  Microcomputer  Chips 

There  are  two  distinct  trends  in  microcomputer  chips;  (1)  the  maturing  of  the  established 
chip  families  to  provide  the  main  choices  of  original  equipment  manufacture  (OEM) 
designers  in  the  1980s  and  (2)  developments  in  VLSI  and  VHSIC  technologies  that  are 
leading  bolder  projects  toward  32-bit  microprocessor  chips  and  16-bit  microcomputer 
chips.  To  explore  the  possibilities  offered  by  the  second  trend,  the  preliminary  design  of  a 
general-purpose  computer  is  reviewed.  Analysis  shows  that  a full  order-of-magnitude 
improvement  in  performance  over  current  avionic  computers  can  be  expected.  Power  and 
weight  will  be  reduced,  and  a greater  degree  of  flexibility  will  be  offered.  The  VLSI  will 
reduce  the  chip  count,  which  should  lead  to  substantial  improvement  in  reliability  because 
the  connections  between  chips  are  a large  source  of  failures. 

The  complexity  brought  on  by  the  large-scale  integration  increases  the  problems  of 
testing,  fault  isolation,  and  fault  tolerance.  Much  more  attention  must  be  paid  to  testing 
and  design  verification  than  with  the  small-scale  circuits  that  presented  many  accessible 
points  for  testing.  While  testing  will  be  more  expensive  in  design  and  development,  these 
requirements  will  eventually  lead  to  reliable  circuits  with  well-defined  failure  modes  and 
failure  coverage. 

G.2.2.2.7  VLSI  Avionic  Computer  Architecture 

The  preliminary  design  of  a general-purpose  VLSI  avionic  computer  is  an  example  of  a 
direction  for  architectures  that  uses  the  capacity  of  the  VLSI  and  VHSIC  technologies.  To 
cover  the  development  costs  of  the  architecture  and  the  chips,  this  design  has  a very  wide 
scope  of  avionic  applications;  it  is  tailored  for  only  flight  control  applications.  The  design 
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provides  much  more  performance  than  is  needed  for  flight  controls.  The  surplus 

capability  may  be  used  to  extend  the  self-tests  and  fault  diagnosis  or  to  perform 
additional  avionic  tasks. 

The  computer  configuration  is  shown  in  Figure  G-5.  The  CPU  is  16-bit  architecture  that 
is  implemented  using  a set  of  "macrocells"  or  chip  building  blocks  that  also  can  be  used 
for  other  architectures,  including  32-bit  ones.  If  the  full  32-bit  capability  is  provided,  the 
power  requirements  will  be  higher  than  those  estimated  and  reported  here.  The  memory 
management  unit  (MMU)  maps  logical  addresses  of  the  CPU  into  the  physical  addresses  of 
the  external  memory.  The  programmable  protocol  for  the  memory  bus  accommodates 
memories  of  any  speed.  The  MMU  has  a cache  memory  to  improve  the  memory  access 
time.  The  I/O  controller  provides  the  interface  between  the  I/O  adapter  chips  and  the 
processor  bus.  It  can  manipulate  complex  data  structures  in  memory,  which  may  be 
required  for  communication  between  processors  in  a distributed  computing  system. 

A comparison  of  the  Honeywell  HDP-5301  computer  board  and  this  hypothetical  VLSI 
design  is  listed  in  Table  G-5.  The  new  design  shows  a tenfold  improvement  in 
performance  with  more  flexibility;  the  chip  count  is  less  by  a factor  of  seven.  This  will 
greatly  improve  the  reliability  of  the  computer  by  reducing  the  troublesome  connections 
between  chips.  Details  of  the  design  follow. 


Figure  G-5.  Very- Large-Scale  Integrated  Circuit  Avionic  Computer  Architecture 
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Table  G-5.  Comparison  of  Current  and  Projected  Avionic  Computers 


Characteristics 

HDP-5301 

1990  VLSI 

Throughput 

500K  ops 

6000 K ops 

Memory  address  capability 

64K  words 

16M  words 

Power 

12.5W 

8.5W 

Number  of  integrated  circuits 

42 

6 

Memory  access  time 

250  ns 

25  ns  (cache  memory) 
85  ns  (main  memory) 

The  key  features  of  the  CPU  architecture  are: 

• A prefetch  instruction  buffer  is  used  to  overlap  instruction  fetching  with  other 
operations. 

• The  microcode  ROM  is  slow  to  minimize  power  consumption.  A double  pipeline 
register  is  needed  to  assemble  microinstructions. 

• The  register  file  and  arithmetic  logic  unit  (ALU)  are  conventional  and  would  be 
similar  for  other  instruction-set  architecture. 

• Miscellaneous  functions  include  bus  control  logic,  the  bus  arbiter,  and  test-and-fault 
tolerance  logic. 

A block  diagram  of  the  CPU  is  shown  in  Figure  G-6. 

The  processor  bus  is  synchronous;  transfer  over  the  bus  is  timed  by  a two-phase  clock.  It 
takes  20  ns  to  make  one  transfer.  The  bus  is  allocated  by  a centralized  arbiter,  located  in 
the  CPU,  using  bus-request  and  bus-grant  signals.  The  arbitration  process  is  overlapped 
with  the  transfer  over  the  bus;  hence,  no  additional  time  is  required  for  bus  allocation. 
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Figure  G-6.  Central  Processing  Unit  Block  Diagram 


The  bus  is  split  cycle.  When  the  current  bus  master  is  performing  a read  operation,  the 
master  sends  the  address  over  the  bus  with  the  proper  control  signals,  and  control  of  the 
bus  is  then  released.  Once  the  data  are  available  and  the  responding  device  receives 
control  of  the  bus,  the  data  are  returned  via  a completely  separate  bus-write  transfer. 
This  split-cycle  operation  allows  bus  transfers  to  be  overlapped  with  the  accessing  of  data 
within  the  responding  devices.  For  instructions  with  register  and  short,  immediate 
operands,  only  the  instruction  word  must  be  fetched  from  memory.  With  the  split-cycle 
bus,  MMU  and  CPU  prefetch  overlap.  The  steady-state  instruction  execution  for  a 
sequence  of  these  instructions  is  eventually  determined  by  the  memory  access  time.  One 
instruction  takes  75  ns  under  the  assumption  of  a 60-ns  memory. 


G-31 


The  power  dissipation  of  the  16-bit  CPU  chip  is  estimated  to  be  1.3W.  The  microcycie 
time  of  the  CPU  is  25  ns;  i.e.,  the  propagation  time  through  the  ALU  and  shifter  is,  at 
most,  25  ns.  Also,  the  propagation  time  through  the  sequencer  and  control  ROM  is,  at 
most,  25  ns.  The  CPU  uses  a pipelined  organization  so  that  instruction  fetch,  instruction 
decode,  and  instruction  operation  can  be  overlapped.  The  instruction  prefetch  unit  has  a 
four-word,  first-in/first-out  buffer  that  it  attempts  to  keep  filled.  It  operates  in  parallel 
with  the  rest  of  the  CPU  and  makes  independent  accesses  of  memory  over  the  processor 
bus.  Under  the  assumptions  of  a 75-ns  access  time  of  main  memory  (from  the  MMU)  and 
an  instruction  mix  of  30%  register-to-register  and  70%  memory-to-register  instructions, 
the  CPU  achieves  an  instruction  execution  rate  of  4.6M  ops.  With  a 20-ns  cache  memory 
in  the  MMU  and  a 65%  hit  ratio,  the  execution  rate  becomes  6M  ops. 

A block  diagram  of  the  MMU  is  shown  in  Figure  G-7.  All  accesses  to  memory  are  routed 
through  the  MMU.  The  receiving  side  of  the  MMU  is  a three-level  pipeline  processor.  The 
three  activities  that  can  occur  in  parallel  are  (1)  input  from  the  processor  bus,  (2)  mapping 
RAM  access  and/or  cache  memory  access,  and  (3)  main  memory  access  over  the  memory 
bus.  The  mapping  RAM  and  control  translate  virtual  addresses  into  physical  addresses  and 
perform  access-error  checks.  In  the  case  of  a read,  if  the  virtual  address  is  contained  in 


Processor  bus  Processor  bus 


Memory  bus  Memory  bus 

Figure  G-7.  Block  Diagram  of  the  Memory  Management  Unit 
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the  cache  memory,  the  word  is  routed  from  the  cache  memory  to  the  output  buffer;  no 
memory  access  is  required.  If  the  word  is  not  present  in  the  cache  memory,  it  is  read 
from  memory,  placed  in  the  output  buffer,  and  then  placed  in  the  cache  memory  if  the 
read  request  was  from  the  CPU.  A write-to  memory  causes  a write  into  the  cache 
memory  if  the  word  is  present  in  the  cache  memory. 

The  MMU  requires  25  ns  to  map  a virtual  address  into  a physical  address;  in  parallel  with 
this  mapping,  the  cache  memory  is  accessed  to  determine  if  the  word  is  present.  For  read 
accesses,  if  the  word  is  not  present  in  the  cache  memory,  an  additional  memory  access 
time  (up  to  75  ns)  is  required  to  retrieve  the  word.  The  cache  memory  is  256  pairs  of 
memory  words.  Based  on  studies  of  similar  cache  systems,  the  hit  ratio  for  the  cache 
memory  should  be  at  least  65%.  A IK  cache  memory  would  increase  the  hit  ratio  to  well 
over  90%. 

The  instruction  set  allows  16  address  states.  For  each  state  there  are  16  mapping 

registers  for  instructions  and  data  and  16  mapping  registers  for  DMA  transfers.  Thus, 

there  can  be  512  mapping  registers;  256  mapping  registers  have  been  specified  for  the 

present  MMU.  The  mapping  can  be  bypassed  for  those  applications  that  do  not  use  the 

5 2 2 

mapping  features.  The  MMU  requires  approximately  2.58  x 10  m (40  000  mil  ) of  chip 
area  and  1.6W  of  power.  Power  is  the  major  limit  on  chip  size,  and  most  of  the  power  is 
used  by  the  RAMs  (cache  and  mapping)  and  the  bus  drivers.  (The  processor  bus  requires 
6-mW  drivers,  and  the  memory  bus  requires  10-mW  drivers.)  The  I/O  controller  (fig.  G-8) 
is  the  interface  between  the  processor  bus  and  an  asynchronous  I/O  bus.  Any  programmed 
I/O  transfers  executed  by  the  CPU  are  recognized  and  processed  by  the  I/O  controller, 
which  processes  interrupts  from  the  I/O  interfaces  and  directs  them  to  the  CPU  as 
appropriate.  DMA  transfers  are  buffered  and  processed  by  the  I/O  controller,  which  can 
function  as  an  I/O  channel  and  execute  the  I/O  instructions.  The  I/O  controller  interfaces 
to  the  processor  bus.  It  also  can  act  as  a processor  bus  master  to  execute  memory 
transfers  and  recognizes  I/O  transfers  with  the  I/O  bus  over  which  it  makes  asynchronous 
self-timed  transfers  to  and  from  the  I/O  interfaces.  Interrupts  from  the  I/O  interfaces 
also  are  received  over  the  I/O  bus.  It  has  a buffer  RAM  for  buffering  messages  and  DMA 
transfers  and  an  ALU  for  performing  address  calculations.  Total  power  for  the  I/O 
con  toller  chip  is  less  than  1.5W. 
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Processor  bus 


Figure  G-8.  Input/Output  Controller 


Three  I/O  interface  chips  have  been  proposed.  The  first  of  these,  shown  in  Figure  G-5,  is 
a multiple  universal  asynchronous  receiver/transmitter  (UART)-Iike  device  with  10  UART 
units.  These  may  transmit  and  receive  at  different  baud  rates;  the  maximum  rate  is 
approximately  10  MHz.  The  multiplex  bus  interface  and  controller  of  Figure  G-8  provide 
redundant  multiplexed  bus  paths.  The  distributed  processing  bus  interface  unit  connects 
multiple  processing  units. 

The  multiplex  bus  interface  chip  is  diagrammed  in  Figure  G-9.  It  contains  the  necessary 
components  to  connect  to  two  buses,  but  communication  can  occur  on  only  one  bus  at  a 
time.  The  bus  adapter  chip  will  monitor  the  inactive  bus  for  mode  commands.  The  I/O 
controller  fetches  the  bus  adapter  instructions  from  main  memory  and  stores  them  in  the 
bus  adapter  control  registers.  The  bus  adapter  is  microcontrolled  and  has  the  capabilities 
for  error-recovery  retries  and  low-level  management  functions.  It  is  designed  to  only 
need  attention  from  the  I/O  controller  on  a message  basis.  The  buffer  RAM  is  sized  to 
accommodate  the  maximum  message  of  32  words.  Two  modes  of  operation  are  allowed: 
(1)  the  master  mode  in  which  the  bus  interface  chip  is  the  controller  of  bus  traffic  and  (2) 
the  remote  mode.  In  the  latter  case,  the  master  is  somewhere  else  on  the  bus.  The  bus 
interface  chip  in  remote  mode  transmits  and  receives  only  on  command  from  the 
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multiplex  bus.  The  bus  interface  chip  will  use  just  under  IW  of  power  and  approximately 
2.58  X 10~^m^  (40  000  mil^)  of  chip  area.  The  Schottky  TTL  drivers  and  the  control  ROM 
are  the  macrocells  that  consume  the  most  power;  together  they  use  nearly  half  of  the 
total  power. 


G.2.2.2.8  Testing 


The  complexity  of  testing  grows  exponentially  with  the  size  of  the  circuit.  Facilities  for 
controlling  and  observing  the  inner  states  of  large  chips  must  be  provided  to  partition  the 
circuit  into  testable  segments.  While  this  need  is  universally  recognized,  there  is  no 
general  agreement  on  how  it  should  be  achieved. 

There  are  many  demands  on  testing  and  they  often  require  complicated  tradeoffs.  The 
requirements  change  during  the  life  cycle  from  design  verification  to  manufacture, 
assembly,  field  use,  and  maintenance;  they  change  with  level  of  detail  from  circuit  to 
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macrocell,  chip,  board,  and  system;  and  they  change  with  the  critical  situation  of  the 
application.  All  these  factors  must  be  reconciled  with  a minimum  overhead  of  chip  area 
and  circuit  delays.  The  testing  provisions  should  not  distract  from  the  chip  designer's 
primary  task  of  producing  clear,  regular  circuits  to  perform  the  functions  of  the 
application. 

Critical  systems,  such  as  flight  controls,  must  have  adequate  test  facilities.  To  establish 
a background  for  adding  tests  to  the  VLSI  avionic  computer  example,  some  current 
techniques  will  be  reviewed.  A technique  in  the  functional  category  seeks  to  demonstrate 
that  the  item  under  test  performs  its  required  functions.  The  techniques  must  consider 
the  specific  processes  that  the  unit  accomplishes.  A nonfunctional  technique  tests  the 
structure  at  the  gate  level  disregarding  the  overall  functions  that  the  network  is  to 
perform.  Testing  for  stuck-at-one  and  stuck-at-zero  faults  is  nonfunctional  because  each 
gate  is  checked  independently  of  the  purpose  of  the  circuit.  In  general,  tests  must  cause 
observable  operation  of  all  internal  devices.  Internal  storage  items,  particularly  "flip- 
flops"  and  latches,  must  be  set  and  observed  directly  with  nonfunctional  techniques.  The 
controllability  and  observability  of  the  storage  items,  other  than  arrays  of  memory,  are  of 
primary  concern  to  the  test  designer.  Specific  methods  are  summarized  in  the  following 
paragraphs. 


Serial-aiift  Registers-Provisions  to  set  and  read  internal  flip-flops  or  latches  may  be 
added  without  much  overhead  in  gate  or  pin  counts.  This  is  done  by  grouping  convenient 
sets  of  these  storage  items  to  form  serial-shift  registers.  These  may  be  read  out  when  the 
testing  mode  of  operation  is  called.  The  contents  of  the  register  may  be  set  by  shifting  in 
a test  sequence,  or  the  contents  may  be  read  out  as  a bit  string  by  similar  sequential 
shifting  of  the  register. 


Nonserial-Shift  Registers— The  serial  approach  requires  a larger  number  of  clock  cycles  to 
shift  the  testing  data  in  and  out  and  to  restore  the  register  to  its  original  condition  when 
the  testing  is  during  normal  operations.  An  alternative  is  to  construct  the  internal  latches 
of  flip-flops  to  be  directly  addressable.  This  approach  has  the  following  advantages: 

• Tests  for  random  logic  and  memory  arrays  can  be  handled  in  one  unified  method. 

• Combinational  output  points  can  be  scanned  with  very  little  overhead;  two  extra 
gates  are  required. 
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• The  scan-out  operation  does  not  disturb  logic  circuit  states  as  does  the  serial-shift 
register  technique. 

• The  scan-in  and  scan-out  operations  will  need  considerably  shorter  time  compared 
with  the  serial-shift  register  techniques. 

Nonserial-shift  registers  have  the  following  disadvantages: 

• Three  to  four  extra  gates  per  storage  element  are  required. 

• Extra  I/O  pins  (10  to  20)  may  be  needed  for  a VLSI  chip. 

• Long  internal  connections  are  needed  for  busing  the  address  lines  and  scan  clock. 

Signature  Analysis— The  shift-register  techniques  require  overhead  that  can  be  reduced  by 
a built-in  test  technique.  The  areas  of  overhead  are  a large  data  base,  the  long  computing 
times  for  test  generation,  and  the  long  time  for  test  application.  Instead  of  using 
software  test  generators  for  producing  the  test  list,  hardware  test  generators  are  used. 
Further,  instead  of  shifting  the  contents  of  the  registers  to  compare  results  every  time  a 
test  is  applied,  a signature  register  can  collect  this  information.  After  applying  a certain 
number  of  tests,  the  final  result  is  shifted  to  compare  it  with  the  expected  signature. 

A shift  register  with  appropriate  feedback  can  be  used  as  a hardware  test  generator.  By 
adding  a few  gates,  a built-in  test  generation/signature  module  can  be  constructed.  This 
module  combines  the  advantages  of  built-in  test  and  serial-shift  register  techniques.  This 
technique  requires  that  all  registers  in  a given  design  be  constructed  in  this  form.  The 
design  is  partitioned  into  modules  consisting  of  two  registers— input  and  output— with 
combinational  logic  between.  The  registers  may  easily  be  multiplexed  to  also  be  used  in  a 
serial-shift  mode.  Thus,  there  is  the  possibility  of  using  the  same  combination  for  factory 
testing  and  for  self-testing  in  the  field. 

Behavioral-Level  Testing- The  design  of  a digital  network  usually  requires  several 
different  descriptions.  A description  is  used  for  modeling,  simulating,  and  testing  of  the 
network.  The  model  depends  on  many  factors,  such  as  the  types  of  faults,  the 
comprehensiveness  of  the  test,  the  data  base  size,  and  the  testing  cost.  With  the 
increasing  use  of  very  dense  logic,  geometrical  modeling  is  needed  to  check  for  design 
rules  and  to  ensure  the  accurate  physical  placement  of  the  devices  inside  the  chip. 
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At  the  behavioral  level,  abstract  specification  of  the  network  is  described  in  a language 
similar  to  ALGOL.  Program  operators  such  as  ADD,  SUB,  MULT,  and  DIV  can  be  used. 
No  fault  model  is  used  for  testing;  the  tests  are  for  functional  accuracy. 

Tests  are  generated  and  applied  to  check  whether  the  network  behaves  according  to 
specifications. 

The  behavioral-level  test  generation  process  is: 

a.  A thorough  analysis  is  done  to  provide  adequate  exercise  of  all  possible  comppnents 
of  the  network  under  test. 

b.  Selected  components  or  macrounits  are  to  be  exercised  to  ensure  adequate  test 
coverage. 

c.  A path  from  inputs  to  the  target  component  is  sensitized. 

d.  A path  from  the  target  to  the  output  is  sensitized. 

e.  Conflicts  are  resolved.  If  this  is  not  possible,  a different  path  or  test  is  selected. 

f.  Items  b to  e are  repeated  until  tests  are  generated  for  all  selected  components  or 
macrounits.  As  a result  of  applying  such  tests  to  the  network,  a response  for  a given 
target  will  be  obtained. 

The  capabilities  of  the  behavioral-level  tests,  in  summary,  are: 

• They  are  available  early  in  the  design  cycle. 

• Test  analysis  can  be  done  early. 

• Each  step  in  the  design  cycle  may  be  Independently  verified. 

• There  is  a large  reduction  in  test  data. 

• Application  time  for  tests  is  short. 

• The  diagnosis  may  be  made  to  functional  subunits. 
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The  limitations  of  the  method  are: 


• It  is  neither  traditional  nor  systematic. 

• It  is  not  useful  with  bottom-up  designs. 

• The  timing  and  implementation  details  are  not  evident. 

• Fault  models  may  not  exist. 

• The  techniques  for  general  path  sensitizations  have  not  been  universally  developed. 

• Diagnosis  to  gate  level  is  not  possible. 

Self-Testing  Circuits-If  enough  logic  is  added  to  the  normal  functional  logic  of  a chip,  a 
very  high  percentage  of  faults  can  be  detected.  Then  the  test  problem  is  reduced  to  the 
determination  of  the  proper  test  stimulus;  all  faults  are  detected  by  the  logic  itself. 
Three  types  of  self -test  circuits  will  be  reviewed:  (1)  residue  coding,  (2)  invariant 
checking,  and  (3)  duplicated  logic. 

The  theory  of  residue  codes  is  well  established.  Data  are  encoded  and  the  code  is  checked 
periodically  along  the  data  path  to  ensure  that  no  faults  have  occurred.  It  is  possible  for 
the  VLSI  components  to  carry  such  a pattern  and  provide  a self-test  capability. 

In  many  circuits,  it  is  possible  to  define  an  invariant  that  monitors  the  relations  between 
the  input  and  the  output.  If  the  circuit  is  working  properly,  this  invariant  is  a constant. 
The  ultimate  in  seif -checking  circuitry  is  to  duplicate  the  logic  and  carry  all  data  in 
error-detecting  codes.  This  approach  requires  considerable  overhead. 

Test  Engine  on  a Chip— The  VLSI  technology  may  make  it  practical  to  include  more 
automation  and  support  of  testing  on  the  chip  than  is  possible  with  current  integrated 
circuit  (IC)  methods.  This  opens  the  complicated  architectural  choice  of  which  testing 
facilities  to  put  on  the  chip  and  which  to  include  in  external  support  equipment.  For 
example,  on  the  chip,  provisions  may  be  included  for: 

• Storage  of  test  vectors  and  test  signatures 

• Generation  of  test  vectors 

• Control  of  the  configuration  for  normal  functions  or  for  testing 

• Test  sequences  for  simultaneous  or  independent  checks  of  section  of  logic 


G-39 


If  the  chip  has  several  components,  it  may  be  advantageous  to  collect  some  of  the 
common  testing  facilities  into  a separate  component  called  the  test  engine.  At  a 
minimum,  the  test  engine  would  read  the  test  and  error  information  from  each  of  the 
components,  format  these  results,  and  communicate  this  information  to  points  external  to 
the  chip.  In  a maximum  configuration,  the  test  engine  would  control  the  testing  phase  for 
each  application  component,  send  out  test  vectors,  check  the  results  of  the  test,  and 
communicate  the  status  of  each  macrocell  to  outside  the  chip.  It  is  clear  that  the 
distribution  of  testing  facilities  between  the  test  engine  and  the  individual  application 
components  will  strongly  depend  on  the  functions  required  of  the  whole  family  of 
components  on  the  chip. 

Testing  Facilities  for  the  VLSI  Avionic  Computer— Some  possibilities  for  the  computer 
architecture  of  test  engine  on  a chip  are  outlined  in  these  paragraphs.  The  approach  is 
diagrammed  in  Figure  G-10.  The  chip  interfaces  are  checked  by  shifting  registers  at  the 
boundaries.  Nonfunctional  tests  are  used  for  all  combinational  logic  segments,  but 
functional  tests  are  used  in  memory-intensive  areas.  A microcontrol  sequencer  in  the 
CPU  controls  the  test  vector  generation  and  comparison  for  all  the  components.  External 
control,  through  an  automatic  test  equipment  (ATE)  system,  may  be  used  for  more 
extensive  fault  isolation  and  extended  fault  coverage. 

The  chip  interconnects  and  associated  circuitry  will  be  much  more  susceptible  to  field 
error  than  the  circuitry  on  the  chip.  To  increase  fault  tolerance,  a redundant  line  can  be 
added  to  data  paths  to  allow  a single  interconnect  failure  in  the  data  path  without 
bringing  the  subsystem  down.  This  involves  using  nonfunctional  testing  at  the  chip 
boundaries  and  requires  control  support  to  allow  the  CPU  chip  to  dynamically  reconfigure 
the  lines  to  lock  out  the  faulty  line. 

The  problems  of  testing  at  chip  manufacture  and  in  the  later  stages  of  fabrication  and 
utilization  will  have  an  impact  on  flight  control  architecture.  These  facilities  will  be 
integrated  and  complemented  with  other  tests  in  software  and  hardware,  which  is  a very 
complicated  realm  for  analysis.  Only  basic  approaches  are  available  now. 
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Figure  G-10.  Testing  Approach 

G.2.2.2.9  Buses 

The  structure  of  the  internal  transfers  of  data,  addresses,  and  control  signals  in  the 
computer  is  a major  component  of  the  computer  architecture,  as  is  the  transfer  of  data 
between  sensors,  computers,  and  actuators.  Internally,  the  concern  is  the  speed  of 
transfer;  control  of  simultaneous  processes;  and  economy  of  registers,  lines,  and  other 
local  hardware.  External  transfers,  particularly  if  serial  multiplexing  is  used,  call  for  a 
host  of  decisions  on  control,  protocol,  redundancy,  fault  tolerance,  and  testing.  The 
hardware  design  is  at  a much  larger  scale  than  registers;  it  involves  interface  chips,  some 
of  which  may  be  as  complex  as  microprocessors. 
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Reference  G-5  gives  a useful  approach  to  outlining  the  choices  for  multiplexed  bus 
architecture.  A summary  of  the  outline  is: 

• General  system  characteristics: 

• Description  of  application 

• System  configuration 

• Description  of  subsystems 

• Bus  control: 

• Control  site 

• Bus  allocation: 

• Mode 

• Inputs  to  algorithms 

• Allocation  algorithms 

• Synchronization  of  trahsmitting/receiving  elements 

• Allocation  scenario 

• Multiplex  data  paths: 

• Physical  and  electric  characteristics: 

• Medium 

• Modulation  scheme 

• Speed 

. • Maximum  distances 

• Transfer  scheme: 

o Synchronization  of  messages 

• Bus  protocol: 

• Transactions: 

• Types 

• Scenarios 

• Addressing: 

• Name  binding 

• Naming  conventions 

• Levels  of  addressing 
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• Message  acknowledgments: 

• Types  of  acknowledgments 

• Information  returned  with  acknowledgments 

• Action  to  positive/negative  acknowledgments 

• Message  size: 

• Fixed  or  variable 

• Minimum/maximum  lengths 

• Determination  of  length 

Fault  tolerance: 

• Bus  control: 

• Error  types  detected 

• Error  types  not  detected 

• Error  handling 

• Transmission  content  errors: 

• Error  types  detected 

• Error  types  not  detected 

• Error  handling 

• Hard  versus  transient  errors 

• Physical  redundancy: 

• Bus 

• Processors 

• Interfaces 

• Reconfigurations 

• Self-tests: 

• Features 

• Coverage 

• Active  or  passive  monitoring 


• Bus  interfaces  and  processors: 

• Types  of  interfaces 

• Distribution  of  communication  functions: 

• Bus  interface 

• Processor/subsystem 

• Application  processors; 

• Types 

• Process  assignments 

• Processor /bus  interface 

• Software  interface 

• Type  of  executive 

• Implementation: 

• Subsystem  terminals 

• Physical  modularity 

• Complexity 

This  outline  was  used  in  Reference  G-5  to  describe  and  compare  a number  of  bus 
architectures,  in  particular  the  standards: 

• MIL-STD-1553A 

• General-Purpose  Multiplex  System  (GMPS) 

• Atomic  Energy  Commission  Computer  Automated  Measurement  and  Control 

• IEEE  488-1975 

In  the  following  paragraphs,  MIL-STD-1553B,  ARINC  429,  and  fiber  optic  buses  are 
reviewed  to  examine  problems  and  make  predictions  on  the  direction  of  bus  architectures. 

MIL-STD-1553B  bus  architecture  provides  more  flexibility  and  capability  than  is  needed 
for  flight  control  systems.  Its  increasing  use  for  avionic  systems  and  industrial 
applications  (ref  G-6)  led  to  the  production  of  component  chips  for  implementations.  This 
also  allows  the  flight  control  system  to  communicate  with  other’subsystems,  including  the 
pilot  display.  Reference  G-6  was  used  in  describing  the  bus.  MIL-STD-1553B 
establishes  the  requirements  for  serial,  digital,  command/response,  and  time-division 
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multiplexing  techniques  on  aircraft.  The  bus  allows  for  the  transmission  of  information 
among  several  signal  sources  interconnected  by  a single,  twisted-shielded  pair  of  wires. 
The  bus  is  a transformer-coupled,  fault-isolated  transmission  line;  data  appear 
differentially  on  the  signal-carrying  wires.  The  serial-data  bus  operates  asynchronously  in 
a command/response  mode.  In  this  serial  systern,  remote  terminals  (RT)  receive  and 
transmit  data  on  the  bus  under  the  command  of  a bus  controller.  Military  systems  require 
at  least  one  redundant  data  bus.  The  bus  is  a half-duplex  system;  i.e.,  transmission  of 
information  is  bidirectional  but  in  only  one  direction  at  a time.  Information  control 
resides  solely  with  the  bus  controller.  In  addition  to  issuing  commands  to  the  RTs,  the  bus 
controller  continously  monitors  traffic  on  the  bus.  For  aircraft  applications,  a general- 
purpose  airborne  computer  serves  as  the  bus  controller,  but  in  less  complex 
configurations,  a dedicated  microcomputer  fills  that  role. 

Information  flow  on  the  transmission  line  is  in  the  form  of  messages  composed  of 
command,  data,  and  status  words.  Each  word  is  20  bits  long  and  is  transmitted  in  a serial, 
digital,  pulse-code-modulated  format.  Information  flows  along  the  bus  at  a 1-MHz  bit 
rate.  Bits  are  transmitted  in  biphase  mode  as  a bipolar,  trapezoidal  signal  with  a positive 
pulse  followed  by  a negative  pulse  and  vice  versa.  Regardless  of  the  word  type— command, 
data,  or  status— the  first  3-bit  time  period  is  called  the  sync  field.  The  sync  field 
distinguishes  between  a command  or  status  word  and  a data  word.  It  is  an  invalid 
waveform  because  the  pulse  period  lasts  for  3-bit  times  instead  of  the  usual  2-bit  times. 
After  the  sync  field,  the  16  bits  that  contain  the  information  to  be  transmitted  or 
received  follow  the  sync  field.  The  last,  or  20th  bit,  is  parity.  It  checks  the  validity  of 
the  16  data  bits.  Odd  parity  is  used  in  1553  systems. 

The  bus  controller  directs  signal  traffic  by  issuing  command  words  containing  the  address 
of  the  RT  that  must  either  listen  to  or  transmit  data  on  the  bus.  The  words  that 
constitute  data  can  be  transferred  from  a controller  to  an  RT,  or  vice  versa,  or  between 
RTs.  In  a controller-to-RT  transfer,  the  RT  can  receive  up  to  32  data  words  and  responds 
to  the  controller  with  a status  word.  For  the  reverse  transmission,  an  RT-to-controller 
transfer,  the  RT  sends  a status  word  and  up  to  32  data  words.  In  an  RT-to-RT  transfer, 
messages  pass  from  one  RT  to  another.  The  controller  first  designates  a receiver  and 
then  issues  a second  command  word  to  identify  the  transmitter.  The  transmitter  responds 
with  a status  word  and  up  to  32  data  words.  The  receiver  answers  with  its  own  status 
word.  In  a fourth  type  of  transfer— a broadcast  message— the  controller  issues  a receive 
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command  to  a specific  address  and  follows  with  up  to  32  data  words.  Only  RTs  equipped 
to  recognize  broadcast  commands  can  recognize  the  address  and  receive  the  data.  No 
status  words  are  issued. 

G.2.2.2.10  ARINC429 

This  specification  defines  the  current  standards  for  the  transfer  of  digital  data  between 
elements  of  avionic  systems  used  in  the  air  transport  industry  (ref  G-7).  The  transmission 
is  in  a single  direction  from  the  output  port  of  the  sending  element  over  pairs  of  twisted 
and  shielded  wires  to  all  other  elements  requiring  the  data. 

Numerical  data  may  be  coded  either  in  two's  that  complement  fractional  binary  notation 
or  in  binary-coded  decimal.  A parity  bit  is  used.  The  receiver  is  not  required  to 
acknowledge  receipt  of  the  data.  Alphanumeric  data  may  be  encoded  in  International 
Standards  Organization  (ISO)  alphabet  No.  5.  Provisions  for  transmitting  graphic  data  will 
be  included  when  a need  is  established. 

The  specification  carefully  defines  the  format  of  each  data  word.  These  consist  of  32  bits 
that  are  partitioned  to  identify  the  type  of  information  (8  bits),  data  source  and 
destination  (2  bits),  sign  and  status  (2  bits),  and  parity  (1  bit).  Files  containing  1 to  127 
records  may  be  transferred;  each  record  contains  1 to  126  data  words.  A 
command/response  protocol  is  defined  for  these  transmissions. 

The  error  detection  is  based  on  the  single  parity  bit  that  is  the  last  bit  of  each  word.  It  is 
encoded  as  odd  parity  on  all  of  the  preceding  31  bits  in  the  word.  There  are  no  provisions 
for  retransmission  of  messages  or  for  the  inclusion  of  redundant  bits  or  other  means  of 
error  correction  in  the  words. 

Return-to-zero  bipolar  modulation  is  used.  Voltage  levels,  transmitter  output  impedance, 
receiver  input  impedance,  and  fault  tolerance  to  overvoltages  and  short  circuits  are 
specified.  The  high-speed  operation  is  at  lOOK  bits  per  second  (bps);  low-speed  operation 
is  between  12.0K  and  14. 5K  bps.  These  are  not  intermixed  on  the  same  bus.  A digital 
word  is  synchronized  by  reference  to  a gap  of  a minimum  of  4-bit  times  between  the 
periods  of  word  transmission.  The  beginning  of  the  first  transmitted  bit  following  this  gap 
signifies  the  beginning  of  a new  word. 
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There  is  a trend  toward  military  applications  of  avionic  equipment  originally  designed  for 
the  airlines.  This  will  produce  the  need  for  some  interfacing  equipment  to  allow  Mark  33 
digital  information  transfer  system  (DITS)  to  couple  to  a 1553  data  bus. 

G.2.2.2.11  Fiber  Optics 

Transmitting  digital  information  by  pulses  of  light  in  glass  waveguides  offers  advantages 
beyond  its  technical  merits.  For  flight  controls,  the  use  of  fiber  optic  buses  is 
advantageous  because  of  high  data  rates  with  few  errors,  their  immunity  to 
electromagnetic  interference  (EMI)  and  electromagnetic  pulse  (EMP)  disturbances,  and 
low-weight  installations.  Transmission  rates  are  expected  to  go  up  to  lOOM  bps  with  a bit 
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error  less  than  one  in  10  bits.  When  they  do  occur,  failures  are  almost  always  in  the 
receiver.  The  life  and  reliability  of  the  current  light-emitting  diode  (LED)  light  sources 
are  low.  Bus  configurations  are  much  more  difficult  to  design  than  using  wires  because  of 
the  loss  in  signal  strength  in  branches  and  connections.  The  connectors  are  difficult  to 
align,  there  is  little  standardization  of  equipment,  and  the  associated  electronics  are  still 
expensive.  These  costs  will  come  down  as  more  integration  is  designed  into  the  circuitry; 
however,  better  techniques  of  bus  control  must  be  developed.  Unless  the  transmission  is 
point  to  point  in  a single  direction,  couplers  must  be  used  to  gain  access  to  the  bus.  These 
are  T-couplers  and  transmissive  and  reflective  star  couplers.  Bifurcation  devices  are 
necessary  if  a station  transmits  and  receives  on  the  same  fiber.  The  cable  may  consist  of 
a single  fiber  or  a bundle  of  fibers;  the  trend  is  to  a single  fiber.  Connectors  are  a 
problem  for  single-fiber  systems  because  the  optical  cores  must  be  carefully  aligned  to 
avoid  excessive  losses  of  signal  strength. 

The  transmitters  are  LED  or  injection  laser  diodes  (ILD).  The  ILD  has  an  output  of  5 to 
10  MW  compared  to  0.01  and  0.02  MW  for  LEDs.  However,  the  ILDs  are  more 
temperature  sensitive,  are  not  as  long  lasting,  and  cost  more  than  the  LEDs.  The 
receivers  are  p-layer  intrinsic  n-layer  (PIN)  photodiodes  or  avalanche  photodiodes  (APD). 
The  APDs  are  more  sensitive,  but  their  high  bias  voltage,  high  temperature  sensitivity, 
and  high  price  make  the  PIN  photodiode  the  usual  choice  for  the  receiving  element. 

The  structure  of  the  bus  system  must  be  carefully  designed  to  maintain  sufficient  signal 
strengths.  Reference  G-8  analyzes  a number  of  configurations  for  a command  and  control 
system.  Projecting  from  this  analysis,  a similar  structure  probably  would  be  best  for 
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flight  controls.  This  architecture  uses  a single  transmissive  star  coupler  to  form  a remote 
terminal  to  service  many  local  users  (fig.  G-11).  Based  on  1977  data,  a 55m  (180-ft)  bus, 
using  LED  sources  and  APD  detectors,  would  result  in  a 30-dB  loss,  which  is  state  of  the 
art. 


G.2.2.3  CONCLUSIONS 


A safe  prediction  is  that  ultrareliable  central  processing  components  will  be  available  in 
the  late  1980s  to  meet  the  needs  of  digital  calculations  for  flight  controls.  The  reliability 
will  come  from  increased  integration  with  reduction  of  chip  counts  and  connections 
between  chips  and  also  by  fault-tolerant  and  self-testing  mechanisms  added  to  the  chips. 
The  size,  weight,  and  power  requirements  of  the  systems  will  no  longer  be  significant 
considerations.  Costs  will  also  be  reduced  to  relatively  unimportant  levels. 


Figure  G-1 1.  Fiber  Optic  Bus  Architecture 
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Standardization  of  instruction  sets  will  permit  accumulation  of  software  support  systems 
and  development  tools  so  that  software  development  for  flight  control  calculations  will 
be  low  cost  and  certifiably  reliable.  This  will  be  enhanced  by  the  trend  to  do  fault 
tolerance  and  self-testing  in  hardware  rather  than  with  complicated  software. 

The  I/O  functions,  already  the  largest  part  of  the  system  design  problem,  will  become 
even  more  dominant  as  the  central  computing  structures  become  routine.  Multiplexed 
busing  of  sensor  data  and  actuator  commands  will  provide  the  critical  technical  problems. 
Fault-tolerant  components  that  will  provide  much  more  capability  than  is  necessary  for 
flight  controls  will  be  used  in  these  systems  because  of  large  production  runs  and 
experience  in  similar  systems.  Fiber  optic  busing  will  be  developed  because  its  resistance 
to  electric  interference  will  justify  the  costs  over  wire  buses. 

There  have  been  many  reviews  and  projections  of  avionic  computer  technology;  e.g.. 
References  G-9,  G-10,  and  G-11.  Reference  G-11  contains  some  especially  relevant 
information,  including  speed,  power,  weight,  and  size  estimates  of  avionic  computers 
projected  for  the  next  20  years. 


G.2.3  SERVOACTUATORS 


G.2.3.1  INTRODUCTION 

The  purpose  of  the  servoactuator  task  was  to  review  the  state  of  the  art  in  actuation 
systems  and  select  candidates  from  configurations  now  in  development.  While  a number 
of  systems  showed  promise  for  the  1990  time  frame,  many  had  deficiencies  that  precluded 
their  selection  at  this  time.  The  study  included  investigations  of  power  characteristics  as 
well  as  control  system  capabilities  and  involved  a wide  variety  of  devices. 

G.2.3.2  CANDIDATE  SYSTEMS 

Systems  to  be  considered  were  divided  into  two  power  source  categories  (hydraulic  and 
electric)  and  then  classified  in  accordance  with  their  energy  efficiency.  A graphic 
representation  of  the  overall  field  is  shown  in  Figure  G-12.  Note  that  all  actuation 
system  types  are  included,  from  conventional  with  independent  functional  control 
augmentation  system  (CAS)  elements  to  integrated  FEW. 
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Figure  G-12.  Candidate  Power  Source  Systems 
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Figure  G-12.  Candidate  Power  Source  Systems  (Continued) 


Electric  Power  Source 


High-Power  Efficiency 


Electric  motor-driven  variable-  Hinge 

displacement  servopumps  moment  ‘ 

powering  conventional 

cylinder-type  actuators  Surface—^ 

(variable  pressure)  Surface  rate  — — 


Manual  and  CAS  Fly  by  wire 


Actuator 


Hinge  moment 
Geared  /. 

servomotor 

(EM  A)  Surface 
Surface  rate^ 


Fly  by  wire 


Actuator 


With  secondary 
actuator 


Integrated  servopump  Geared  servomotor 


Valid  configurations  for  surface 
and  secondary  actuators 


Surface 


• Electromechanical  surface  actuation; 
only  practical  mechanization  is  with 
completely  integrated  surface  actuator 

• Linear  output  (ballscrew  drive) 

• Single  motor/gearbox  used  singly 
or  in  combination 


VII  Surface  actuators  VIII  CAS  actuators  and  IX  Integrated  actuators 

secondary  actuators  .....  . ... 

• Nonregenerative;  no  (see  column  II)  All  configurations  * W^'t'P'e-wound  motors  used  singly 

recovery  of  control  require  internal  ^ 

surface  energy  stroking  servo;  ..... 

. ^ ...  eMultiple  motors  on  common  gearbox 

characteristics  similar  “ 

Regenerative;  control  to  those  in  column  III  ^ ^ 


> Multiple-wound  motors  used  singly 
with  one  gearbox 


• Regenerative;  control 
surface  energy 
recovered 

• Mechanical;  flywheel 
on  drive  motor 

• Ac  induction  motor 

• Dc  motor/generator 


► Rotary  output  (direct  gearing  to 
control  surface  hinge) 

• Single  motor/gearbox  used  singly 
or  in  combination 

• Multiple-wound  motors  used  singly 
with  one  gearbox 

• Multiple  motors  on  common  gearbox 


Figure  G- 12.  Candidate  Power  Source  Systems  ( Concluded) 


G.2.3.2.1  Actuation  Systems  Using  Hydraulic  Power 

Present  aircraft  use  a complex  hydraulic  power  generation  and  distribution  system  that 
has  evolved  after  many  design  cycles.  It  is  reliable  and  relatively  easy  to  maintain. 
Careful  design  has  provided  adequate  protection  from  probable  failure  patterns,  but  the 
simple  cylinder-type  actuators  used  in  most  systems  operate  with  low  energy  efficiency. 
There  are  alternatives,  but  their  performance  appears  questionable. 

Conventional  Cylinder-Type  Actuators-Most  of  these  devices  operate  from  a fixed- 
pressure  hydraulic  supply.  They  use  a simple,  reliable,  flow-control  servovalve 
(mechanically  or  electrically  operated)  to  vary  the  amount  of  fluid  entering  and  leaving 
the  cylinder.  A thorough  knowledge  of  servomechanisms  and  structural  dynamics  enables 
systems  to  be  built  with  complete  control  of  acceleration,  velocity,  and  position. 

Hydromechanical  surface  actuators  may  be  built  in  a variety  of  forms,  any  of  which  may 
use  separate  electrohydraulic  or  electromechanical  servoactuators  for  the  insertion  of  the 
automatic  control  signal.  Redundant  signal  and  power  supply  paths  are  included  for 
reliability. 

Hydromechanical  surface  actuators  are  servomechanisms  that  use  hydraulic  energy  to 
position  the  control  surface  against  variable  aerodynamic  loads.  The  mechanical  input 
energy  required  can  be  very  low.  The  basic  elements  needed  are  cylinder  and 
mechanically  operated  servovalve.  Redundancy  requirements  dictate  the  use  of  multiple 
separated  hydraulic  supplies,  so  dual  or  triple  valves  and  cylinders  are  commonly  used. 
These  may  be  arranged  in  tandem  or  parallel  (sometimes  joined)  construction,  or  they  may 
be  mounted  as  individual  assemblies.  Valves  may  or  may  not  be  integrated  into  the 
cylinder  construction. 

Electric  command  signals  from  the  automatic  control  system(s)  are  used  to  position  the 
output  of  these  servoactuators.  Reliability  requirements  dictate  the  use  of  redundancy, 
and  it  is  the  methods  by  which  the  redundancy  is  mechanized  that  distinguish  the  various 
types  of  actuation  systems.  Electrohydraulic  systems  may  use  methods  that  dedicate  a 
hydraulic  channel  to  a control  channel,  or  the  control  channels  may  be  crossfed  to  all 
hydraulic  channels.  Electromechanical  actuation  channels  are  normally  dedicated  to  a 
control-channel-related  electric  supply. 
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When  the  aerodynamic  efficiency  of  an  airplane  is  improved  by  reducing  the  stability 
margin,  the  reliable  operation  of  a stability  augmentation  system  (SAS)  becomes  a matter 
of  flight  safety.  To  comply  with  flight  safety  requirements,  redundant  electric 
servoposition  commands  are  used  to  control  a suitably  redundant  actuator.  The  resulting 
control  system  is  so  reliable  that  electric  pilot  commands  can  be  used  to  replace  the 
mechanical  control  system,  and  FBW  system  advantages  are  realized. 

An  effective  mechanical  crossfeed  may  be  achieved  by  using  a full-authority  redundant 
electrohydraulic  or  electromechanical  servoactuator  to  position  a conventional 
hydromechanical  surface  actuation  system.  The  former,  termed  a secondary  actuator, 
may  be  mounted  in  any  manner  that  provides  a convenient,  reliable,  mechanical 
interconnect. 

The  secondary  actuator  may  be  packaged  with  the  surface  actuator  to  eliminate  any 
exposed  mechanical  linkage,  or  the  secondary  actuator  may  be  sized  to  handle  the  control 
surface  loads  directly.  In  either  case,  they  are  called  integrated  actuators. 
Contemporary  examples  of  integrated  actuator  systems  are  on  the  F-16  and  F-18  aircraft. 

High-Efficiency  Hydraulic  Power  Actuators— The  heavy  losses  associated  with  servovalve- 
controlled  cylinders  may  be  reduced  by  using  alternative  actuation  methods;  i.e.,  methods 
that  do  not  use  loss-generating  devices  such  as  closed-center  servovalves. 

One  scheme  uses  a variable-displacement  hydraulic  motor  that  is  geared  to  the  control 
surface.  Increasing  the  displacement  of  the  motor  has  an  effect  similar  to  the  opening  of 
the  servovalve  in  a conventional  valve  and  cylinder  arrangement.  Unfortunately,  motor 
displacement  control  usually  requires  input  forces  and  velocities  greater  than  those 
available  in  a manual  system,  so  some  type  of  boost  actuator  is  required. 

The  motor  may  be  geared  directly  to  the  surface  hinge  line,  to  an  operating  lever,  or  to 
the  surface  horn  via  a ballscrew.  In  any  design,  the  failure  modes  and  probabilities  must 
be  carefully  assessed  for  each  redundant  system  being  considered. 

The  variable-displacement  hydraulic  motor  can  be  used  either  in  a manual  plus  CAS 
configuration  or  in  an  FBW  configuration,  as  shown  in  Figure  G-12.  For  FBW  applications, 
an  integrated  actuator  can  be  achieved  by  incorporating  an  electrohydraulic  servoactuator 
into  the  motor  for  displacement  control. 
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G.2.3.2.2  Actuation  Systems  Using  Electric  Power 


Using  multiple  electric  power  distribution  systems  and  electrically  powered  actuators 
offers  several  advantages  over  a hydraulic  system.  How  that  power  is  used  at  the  control 
surface  depends  on  space  requirements  and  on  how  redundancy  must  be  achieved. 

Servoamps-A  constant-speed  electric  motor,  driving  a variable-displacement  hydraulic 
pump  directly  connected  to  a cylinder,  can  be  controlled  in  a way  similar  to  the  variable- 
displacement  hydraulic  motor  described  previously.  However,  because  there  is  no  supply 
of  constant-pressure  hydraulic  fluid  for  the  "stroking  servo,"  a small  hydraulic  system  also 
must  be  driven  by  the  motor.  Because  there  is  no  large  servovalve  and  because  some  of 
the  surface  positioning  energy  can  be  recovered,  a minimal  amount  of  heat  is  generated, 
and  electric  motor  power  can  be  quite  low. 

The  stroking  servo  can  be  commanded  by  mechanical  signals  from  the  pilot  and  a CAS 
actuator.  If  only  electric  commands  must  be  followed,  an  FBW  actuator  results. 

An  electrically  powered  FBW  actuation  package  is  easy  to  maintain;  only  the  rod  ends  and 
the  electric  connectors  need  to  be  removed  for  service. 

A multichannel  secondary  actuator,  powered  by  the  single  local  supply,  can  be  used  to 
control  the  servopump,  or  several  servopumps  may  be  controlled  by  one  secondary 
actuator.  The  latter  involves  an  added  set  of  mechanical  connections  or  some  hydraulic 
interconnects  or  both. 

Integral  stroking  pistons,  controlled  by  a pump-mounted  electrohydraulic  servovalve 
(EHV),  can  provide  control  for  a completely  integrated  package. 

Electromechanical  Actuator— Development  of  high-efficiency  brushless  dc  servomotors 
resulted  in  a beneficial  way  to  power  control  surfaces.  Compact,  hinge-line  actuator 
designs  and  ballscrew  drives  both  appear  as  candidate  systems.  The  gearing  method  must 
be  carefully  selected,  as  the  reliability  and  failure-mode  considerations  of  those  elements 
are  most  important. 
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While  it  is  possible  to  build  an  EMA  with  mechanical  inputs  that  could  replace 
hydromechanical  surface  actuators  in  a conventional  manual  control  system  plus  CAS  or 
FEW  with  a secondary  actuator  system,  the  real  potential  for  the  EMA  is  in  integrated 
actuator  designs  for  FEW. 

G.2.3.3  QUALITATIVE  TRADES 

Four  basic  actuation  systems  were  examined  from  the  point  of  view  of  performance, 
weight,  cost,  maintainability,  and  developmental  risk.  Of  particular  interest  were  their 
applicability  to  FEW  and  their  potential  for  simplification. 

G.2.3.3. 1 Conventional  Hydraulic  Cylinder-Type  Actuators 

These  have  been  the  most  popular  actuators  for  flight  control  surfaces  because  they  have 
excellent  design  flexibility  (bore/stroke  ratios,  tandem  and  side-by-side  combinations, 
etc.)  and  have  progressed  through  years  of  development,  resulting  in  a thorough 
understanding  of  the  principles  involved.  Excellent  dynamic  performance  can  be  achieved 
in  both  single  and  multichannel  systems,  and  failure  modes  can  be  well  defined.  These  are 
the  lightest  weight  actuators  now  available  (advanced,  higher  pressure  actuation  systems 
are  even  lighter)  and  costs,  which  include  the  control  electronics,  are  low.  Although 
maintenance  of  conventional,  individual-component  systems  is  more  difficult,  advanced 
integrated  actuator  FEW  designs,  using  "plug-in"  line  replaceable  units  (LRU),  show 
substantial  improvements  in  this  area.  Reliability  and  service  life  are  excellent. 

G.2.3.3.2  Geared  Variable-Displacement  Hydraulic  Motors 

Theoretically,  this  arrangement  is  energy  efficient;  however,  the  performance  is 
inadequate.  No  known  motor  designs  (there  are  improved  configurations  under 

development)  can  meet  the  small-signal  deadband  requirements  for  a high-performance 
flight  control  system. 

G.2.3.3.3  Electrically  Powered  Servopumps 

The  concept  of  electrically  powered  servopumps  was  developed  by  the  Germans  during 
World  War  II.  It  was  made  flightworthy  by  the  English  and  used  commercially  in  the 
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VC- 10.  The  element  geometry  is  similar  to  the  variable-displacement  motor,  and  it  also 
has  deadband  and  small-signal  performance  deficiencies.  However,  it  shows  the  potential 
for  greatest  overall  efficiency  if  performance  weakness  can  be  overcome.  Maintainability 
is  excellent,  reliability  is  high,  and  adaptability  to  FBW  is  encouraging. 

G.2.3.3.4  Electromechanical  Actuation 

Although  EMAs  have  been  used  for  autopilot  and  SAS  actuators  for  years,  recent 
developments  in  high-efficiency,  brushless,  permanent-magnet  motors  have  prompted  the 
design  of  higher  powered  devices.  It  now  appears  that  actuators  for  all  surfaces  of  the 
subject  vehicle  are  feasible.  However,  the  design  of  high-ratio,  high-efficiency  gearing 
that  can  allow  the  actuator  to  meet  both  performance  and  failure-mode  requirements 
remains  risky,  particularly  for  the  larger  sizes.  Weight,  including  the  associated 
electronics,  is  low  enough  to  be  competitive,  and  maintainability  is  an  outstanding 
feature. 

G.2.3.4  CONCLUSIONS 

The  ACT  configuration  has  relaxed  static  stability  in  the  pitch  axis  for  energy  efficiency. 
An  operable  pitch-augmentation  system  is  essential  to  safe  flight.  A minor  extension  of 
the  pitch-augmentation  system  allows  incorporation  of  FBW  control.  FBW  control  in  all 
three  axes  is  recommended  so  that  performance,  weight,  cost,  and  maintainability 
benefits  attributable  to  FBW  will  be  at  a maximum. 

A close  examination  of  all  control  surfaces  showed  that  the  loads,  dynamic  performance, 
and  redundancy  necessary  for  FBW  could  best  be  met  by  conventional,  cylinder-type 
hydraulic  actuators.  The  lightest  weight,  lowest  cost,  most  reliable,  and  most  acceptable 
maintainability  will  be  possible  if  conventional  hydraulic  actuators  of  the  integrated  type 
are  used. 

The  flaperon  installations  required  that  power  to  the  actuator  be  supplied  across  the  wing- 
flap  interface.  In  this  instance,  the  use  of  an  EMA  to  operate  the  flaperon  simplifies  the 
problem  and  is  therefore  recommended.  The  use  of  EMAs  throughout  the  aircraft  was 
also  considered,  but  the  relatively  large  number  of  unknowns  and  the  added  study  effort 
required  to  properly  define  a design  were  sufficient  causes  for  rejection. 
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G.2.4  SOFTWARE  DESIGN  AND  VALIDATION 


This  subsection  discusses  the  possibility  of  designing,  verifying,  and  validating  flight 
control  software  so  that  it  can  be  certified  to  be  free  of  technical  and  global  errors  and  so 
that  it  will  respond  to  all  normal  circumstances  and  all  hypothetical  failures  as  specified. 

Flight  control  software  must  be  error  free.  In  a multichannel  system  that  is  critical  to 
flight  safety,  a software  error  that  is  copied  into  each  channel  may  result  in  a serious 
single-point  failure.  Software  errors  usually  are  thought  of  as  technical  errors  such  as 
typing  mistakes,  spelling  errors,  misplaced  decimal  points,  or  mistakes  in  signs  or 
operation  symbols.  Segment-by-segment  simplicity  of  flight  control  software  and 
attention  to  inspection,  testing,  and  the  use  of  software  development  tools  will  eliminate 
software  technical  errors. 

Design  errors  of  a global  nature  are  harder  to  prevent.  These  appear  as  inconsistencies  or 
conflicts  between  two  separate  functions,  or  as  errors  of  omission  in  which  some 
combination  of  events  has  been  overlooked  in  the  analysis.  However,  the  special  nature  of 
flight  controls  allows  a systematic  description  and  analysis  so  a design  and  validation 
methodology  can  be  constructed  to  eliminate  such  situations.  This  methodology  has  not 
yet  been  completely  demonstrated,  but  progress  is  being  made  by  a number  of 
investigators.  Thus,  flight  control  software  can  be  specified,  designed,  analyzed,  and 
tested  so  it  can  be  certified  to  be  free  of  design  and  technical  errors  for  all  normal 
operations  and  for  a specified  class  of  hardware  failures. 

Because  it  is  important  to  be  precise  about  what  is  being  covered  and  what  is  not, 
attention  should  be  directed  to  definitions.  A distinction  is  made  between  verification 
and  validation.  Verification  applies  to  software;  it  is  the  process  of  demonstrating  that 
software  is  technically  correct  by  showing  that  each  software  function  performs  as 
specified  and  the  technical  aspects  of  inputs,  outputs,  and  the  passage  of  data  between 
functions  are  correct.  It  must  be  shown  that  the  data  that  define  the  state  of  the 
function  are  not  corrupted  by  any  side  effect  so  that  the  data  survive  to  the  subsequent 
cycles  of  the  calculations.  Validation  applies  to  the  system;  it  is  the  process  of  showing 
that  the  system  performs  according  to  its  requirements  and  reacts  favorably  to  all 
situations. 


G-58 


The  importance  of  verification  and  validation  grows  proportionately  with  the  trend  to 
delegate  larger  percentages  of  the  system  functions  to  software.  As  the  software 
becomes  more  complex  or  more  critical,  verification  and  validation  must  become  more 
systematic  and  formal,  and  they  must  establish  complete  confidence  in  the  performance 
of  the  software.  This  implies  that  "black-box"  testing  is  no  longer  adequate.  To  handle 
the  complexity,  the  system  structure  must  be  clear,  precise,  and  complete.  This 
inevitably  leads  to  a more  mathematical  approach;  we  have  found  that  hierarchies  of 
finite-state  machines  are  very  suitable  for  the  description  and  design  of  flight  control 
systems. 

The  functional  and  performance  requirements  of  the  system  must  be  made  sufficiently 
precise  to  provide  a basis  for  design  and  subsequent  verification  and  validation.  In  this 
case,  "requirements"  refers  to  the  informal  descriptions  from  the  customer  and 
"specifications"  refers  to  the  precise  written  description  compiled  from  the  requirements. 
The  preparation  of  an  adequate  specification  is  difficult  and  tedious  but  crucial  to  the 
success  of  design  and  validation  of  the  system.  Specifications  will  be  discussed  in  more 
detail  in  a subsequent  section. 

Although  the  verification  and  validation  methodology  proves  many  functions,  there  are 
several  that  it  cannot  prove.  It  is  not  possible  to  predict  the  response  of  a computer  to  all 
possible  failures  of  its  hardware.  The  most  elaborate  failure-and-effects  analysis  can  only 
enumerate  the  most  probable  failure  modes.  Because  there  is  a vast  number  of  states  in 
which  the  computer  may  be  when  a failure  occurs,  the  outcome  can  be  only  a guess.  The 
system  must  be  configured  so  that  there  are  no  failures  that  can  put  the  airplane  in 
jeopardy.  Although  our  proofs  can  only  show  that  the  system  is  safe  against  classes  of 
hypothetical  mathematical  failures,  experience  has  shown  that  all  physical  failures  have 
been  covered. 

Software  development  begins  with  writing  the  specifications  that  describe  what  the 
system  will  do.  Specifications  do  not  describe  how  the  system  performs.  The  next  step  is 
to  design  the  software  and  verify  that  the  specifications  have  been  captured  correctly. 
When  this  is  done,  the  design  is  coded  and  the  code  is  verified  to  implement  the  design. 
After  the  software  has  been  integrated  with  the  hardware,  the  validation  that  the  system 
performs  as  specified  begins. 
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In  detail,  the  conclusions  (ref  G-12)  to  be  supported  in  this  section  are: 

1.  Software  for  flight  controls  is  not  intricate.  The  observation  that  the  functions  of 
flight  control  systems  are  elementary  is  important  to  the  discussion.  The  assembly 
programs  for  current  triply  redundant  systems  are  about  10  000  lines,  but  the  code 
may  be  structured  into  a large  number  of  simple  functions.  The  data  structures  are 
also  elementary.  There  are  fixed  sets  of  inputs,  outputs,  and  state  variables.  The 
control  structure  is  direct  with  no  complicated  "while-do"  loops.  The  flight  control 
laws  require  only  straight-line  computations  that  have  no  peculiar  singularities  that 
need  delicate  numerical  analysis.  The  logic  functions  may  be  structured  as  finite- 
state  machines  to  allow  precise  design  and  verification.  A construction  that  causes 
problems  on  special  circumstances  will  probably  not  survive  a careful  inspection  on 
the  code.  This  includes  obscure  assembly  programming  manipulations  that  are  easily 
detected  by  an  independent  inspection. 

Testing  is  primarily  used  to  show  that  there  are  no  typographical  errors  in  the  code. 
It  is  generally  very  effective. 

The  software  for  high-performance  aircraft  may  be  more  complicated  in  the  future. 
Examples  of  new  control  techniques  that  require  more  complicated  calculations  are: 

• Adaptive  gain  mechanizations 

• Flutter-mode  suppression 

• Analytical  redundancy  for  sensor  failures 

• Wing-load  alleviation 

Verification  of  these  functions  will  not  require  special  techniques. 

2.  Each  function  may  be  verified  by  one  or  more  techniques.  For  most  of  the 
functions,  input  and  output  predicates  may  be  written,  and  the  computation  may  be 
verified  by  symbolically  evaluating  all  the  path  conditions.  Boolean  symbolic 
evaluation  of  the  logic  functions  is  certain  because  of  the  cross-checks  afforded  by 
multiple  paths.  The  control  laws  may  be  verified  with  confidence  by  frequency- 
response  analysis  on  a simulation.  Petri  nets  may  be  drawn  to  check  the 
synchronization  of  the  redundant  computers. 
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3. 


Integration  of  functions  into  the  total  program  may  be  verified  completely.  Data 
flows,  initialization  and  integrity  of  state  variables,  consistency  and  lack  of 
circularity  of  function  references,  and  all  the  technical  details  required  in 
combining  the  individual  functions  may  be  demonstrated  by  hand  or  with  the 
assistance  of  tools. 

4.  The  approach  to  design  and  verification  can  be  made  systematic  and  formal  to  any 
desired  level.  The  word  "formal"  implies  that  precise  definitions,  rigorous  analysis, 
and  systematic  procedures  are  written.  Tools  may  be  added  until  a completely 
machine-supported  approach  to  verification  is  achieved.  Thus,  technical 
verification  that  the  software  conforms  to  its  design  specifications  may  be  done 
with  complete  certainty.  However,  the  reliance  that  must  be  placed  upon  the 
programmer  or  verifier  is  directly  related  to  the  lack  of  automation  of  the 
methodology.  Automation  enforces  discipline  on  the  design  and  verification  process. 

5.  Most  tools  or  techniques  prove  only  a particular  aspect  of  the  design  or  code;  some 
are  clearly  directed  at  particular  properties.  The  set/use  checker  and  the  circular 
reference  checker  are  examples.  Even  the  more  general  tools  and  techniques 
require  explicit  and  sometimes  implicit  assumptions  to  hold  during  their  use.  An 
automatic  theorem  prover  assumes  that  the  input  and  output  assertions  are 
complete  and  represent  the  functional  requirements  of  the  segment.  Thus, 
combinations  of  tools  are  required  and  judgment  in  their  use  must  be  exercised. 
There  is  always  the  fundamental  assumption  that  the  requirements  are  complete  and 
have  been  captured  correctly  by  the  top-level  mathematical  model  of  the  system. 

The  tools  of  static  analysis  can  be  very  useful  in  the  software  development  process. 
Not  only  may  they  be  used  at  the  coding  level,  but,  at  the  cost  of  introducing  formal 
languages  with  syntax,  they  may  be  used  at  the  design  and  specification  levels. 
Dynamic  tools  greatly  facilitate  and  systematize  the  testing  procedures.  It  has  been 
customary  to  leave  the  testing  at  the  function  level  to  the  control 
analyst/programmer.  Instrumentation  and  drivers  to  monitor  and  execute  tests  are 
generally  customized  by  the  flight  control  analyst  to  check  out  his  particular 
program. 
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6.  Validation  of  the  normal  system  operation  is  possible.  The  work  becomes  more 
difficult  as  it  moves  out  of  the  realm  of  verification  of  software  into  the  total 
system.  Performance  measures  may  be  checked,  and  computation  of  control  laws 
may  be  verified  and  validated  by  checking  the  frequency  response  of  the  system. 
The  normal  operation  of  a flight  control  system  is  not  so  complicated  that  it  cannot 
be  thoroughly  checked  in  simulation.  Inductive  arguments  in  this  regard  are  seldom 
explicitly  considered  or  stated. 

7.  Validation  of  the  system  response  to  hardware  failures  is  difficult.  It  will  be 
possible  to  demonstrate  the  consistency  of  failure  management  provisions  and  global 
performance  of  the  system.  This  is  a subject  for  current  research.  The  effects  of 
hypothetical  sets  of  failures  may  be  validated.  It  is  not  possible,  however,  to  be 
certain  that  the  responses  to  all  hardware  failures  are  covered  by  the  mathematical 
description  of  the  system. 

In  the  following  paragraphs,  a methodology  for  flight  control  software,  from 
specifications  to  validation,  will  be  outlined.  Although  many  approaches  and  variations 
are  possible,  only  one  will  be  demonstrated. 

G.2AA  FLIGHT  CONTROL  FUNCTIONS 

The  software  for  a flight  control  system  usually: 

Initializes  the  computers 

Performs  preflight  built-in  tests 

Synchronizes  the  computers 

Initializes  filter  variables  and  status  variables 

Monitors  the  dynamic  sensors 

Manages  system  redundancy 

Performs  the  mode  logic 

Calculates  the  control  laws 

Runs  the  in-flight  self-tests 

Selects  signals  for  outputs 

Provides  status  and  warning  signals 
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A study  of  typical  systems  suggests  that: 


• The  functions  separate  well  to  allow  a carefully  structured  design  for  each. 

• The  interfaces  between  the  functions  can  be  clearly  defined.  Circular  references 
may  be  avoided. 

• The  state  variables  of  each  function  are  easily  identified.  These  are  quantities  that 
must  be  preserved  for  the  next  iteration  of  the  computations. 

• The  functions  may  be  packaged  into  any  executive  structure  that  is  appropriate. 

• There  are  only  a few  "while-do"  loops.  These  loops  wait  for  an  external  signal  to 
cause  synchronization,  trap  the  computation  until  the  watchdog  times  out  to  shut 
down  the  system,  or  wait  until  the  real-time  counter  times  up  to  a particular  value. 
There  are  no  doubts  about  termination  of  the  loops  in  any  of  these.  All  other  loops 
are  indexed  for  a fixed  number  of  iterations.  Thus,  the  theoretical  structure  of  the 
software  is  not  complicated. 

• Most  of  the  functions  are  easy  to  design  and  may  be  exhaustively  tested  for  all 
events. 

• There  is  usually  only  a very  simple  interrupt  structure  for  responding  to  the 
watchdog  timer  or  fluctuations  in  the  power  supply. 

• The  data  structure  is  elementary.  There  are  no  problems  with  overflow  of  the  data 
base  because  the  numbers  of  variables,  parameters,  and  constants  are  fixed.  The 
state  of  each  module  is  determined  by  a fixed  number  of  variables.  There  are  no 
problems  with  dynamic  indexing  of  arrays. 

• The  functions  that  control  the  flow  of  the  calculations  (synchronization,  monitoring 
sensors,  redundancy  management,  mode  logic,  and  signal  selection)  may  be 
represented  as  finite-state  machines. 
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These  points  are  listed  to  emphasize  that  the  software  for  flight  controls  is  not 
complicated.  The  huge  error  counts  that  occur  in  large,  general  software  systems  are  not 
relevant  here.  In  addition,  the  criticality  of  the  system  requires  careful  attention  to  the 
quality  of  the  software;  a system  cannot  be  put  into  the  field  to  let  the  customer  find  the 
errors  as  has  been  done  with  large  operating  systems.  Because  the  software  is 
elementary,  a precise  verification  methodology  Is  possible  and  can  be  used  effectively. 

G.2.4.2  SPECIFICATIONS 

A mode  of  description  is  needed  that  will  make  the  specifications  public  and  easily 
accessible  for  review  and  changes.  It  should  be  complete  so  that  omissions  and 
inconsistencies  are  readily  detected.  Fortunately,  there  is  such  a mode  for  flight 
controls. 

A flight  control  system  provides  stability  augmentation,  control  augmentation,  outer  loop 
modes  for  relieving  the  pilot,  and  warning  and  status  signals.  The  state  of  the  system  Is 
described  by  the  servo  engagements,  the  mode  being  computed,  and  the  status  of  its 
redundant  facilities.  The  system  can  be  in  one  of  a small  fixed  number  of  possible  states. 
Abstractly,  it  is  a finite-state  machine,  which  is  a device  that  has  a fixed  set  of  internal 
storage  elements  that  determines  the  state.  When  an  input  is  received,  the  machine 
switches  to  a new  state  depending  upon  the  input  and  the  current  state.  While  any 
practical  computing  device  has  a finite  number  of  states,  the  concept  has  utility  only  if 
the  number  of  states  is  small.  Describing  the  flight  control  system  as  a finite-state 
machine,  which,  in  turn,  is  represented  as  a group  of  smaller  machines,  defines  a structure 
that  can  be  used  for  the  basis  of  the  specification.  At  each  subsequent  stage  of 

development,  verification  begins  by  showing  that  this  structure  has  been  correctly 
implemented. 

Two  levels  of  specifications  are  needed;  the  first  describes  the  functions  of  the  system 
regardless  of  whether  they  are  implemented  by  hardware  or  software  and  the  second 
describes  the  software  functions,  taking  into  account  the  hardware  facilities.  The 
software  is  designed  and  coded  to  the  second  specification,  but  it  must  be  verified  that 
the  software  functions  plus  the  hardware  facilities  perform  the  system  functions  as 
specified.  Those  functions  that  are  done  completely  by  the  software  are  the  same  at  each 
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level  and  need  not  be  specified  twice.  This  approach  has  been  used  for  a simple  flight 
control  system  (ref  G-13).  That  application  provides  a convenient  example,  which  is 
discussed  in  the  following  paragraphs. 

At  the  system  level,  the  state  may  be  defined  in  terms  of  the  services  being  provided.  In 
the  example,  these  are  commands  to  the  flight  director,  the  yaw  damper,  and  the 
autopilot.  Interpretation  of  the  requirements  leads  to  defining  the  system  by  six  states, 
as  listed  in  Table  G-6.  After  the  system  is  defined,  the  next  task  is  to  list  all  the  events 
that  may  cause  the  system  to  change  to  a new  state.  Only  the  17  events  in  Table  G-6 
control  this  aspect  of  the  flight  control  functions.  The  events  are  assumed  to  occur 
independently.  If  combinations  can  occur,  they  should  be  listed  as  defining  a new  event. 
The  list,  which  was  arrived  at  by  much  discussion,  shows  one  of  the  advantages  of  the 
approach:  the  specifications  are  highly  visible.  The  entries  in  the  body  of  the  table  show 
the  new  state  to  which  the  system  transitions  when  the  event  occurs.  The  dashes  indicate 
that  for  the  given  state,  the  event  cannot  occur.  For  example,  if  the  system  is  in  state  1 
with  the  flight  director  switch  ON,  the  flight  director  switch  must  already  be  on,  so 
event  1 is  not  possible.  The  table  describes  an  abstract  machine;  it  makes  no  distinctions 
on  how  the  hardware  and  software  interface.  That  comes  in  the  next  step. 

Table  G-7  lists  the  transitions  that  must  be  implemented  by  the  software.  Some  of  the 
events  of  Table  G-6  have  been  combined  with  events  in  this  table,  and  the  features  of  the 
interfacing  hardware  have  been  used.  The  following  terms  are  used  in  both  tables: 

• Flight  director  flag  Vertical  gyro  valid  AND  BIT  reports  OK 

• Yaw  damper  flag  Flight  director  flag  AND  NOT  autopilot  dump 

switch  AND  yaw  rate  power  ON 

• Autopilot  flag  Yaw  damper  flag  (NOT  manual  electric  trim  on 

OR  control  wheel  steering  switch  ON)  AND  trim 
monitor  OK 

The  software  provides  the  transitions  and  outputs  shown  in  Table  G-7.  A verification  task 
is  to  show  that  the  system  correctly  performs  the  events  listed  in  Table  G-6. 
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Table  G-6.  Abstract  System  Machine 
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Flight  director  OFF 
Yaw  damper  OFF 
Autopilot  OFF 


Flight  director  ON 
Yaw  damper  OFF 
Autopilot  OFF 


Flight  director  OFF 
Yaw  damper  ON 
Autopilot  OFF 


Flight  director  ON 
Yaw  damper  ON 
Autopilot  OFF 
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Initiates  a 2.5-sec  fade-on  ramp. 


[£>  All  transitions  shutting  off  the  autopilot  flash  light  and 
sound  horn;  the  g-dump  is  directly  wired. 

Note:  Starting:  state  0.  The  control  wheel  steering  switch 

alters  the  flight  direaor  output  in  1,  3, 4,  5. 
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A mode  switch  ON  when  flight 
director  is  OFF 
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Table  G-7.  Software  System  Machine 


Event  1 

Flight  director  flag  FALSE 

Flight  director  button  ON 
AND  flight  director  flag  TRUE 

Go-around  switch  ON  AND 
flight  director  flag  TRUE 

Control  wheel  steering  switch  ON 
AND  flight  director  flag  TRUE 

Control  wheel  steering  OFF 

A mode  switch  ON  AND  flight 
director  flag  TRUE  (AND  NOT  FD) 

Yaw  damper  engaged  TRUE  AND 
yaw  damper  flag  TRUE 

Yaw  damper  engaged  FALSE 
OR  yaw  damper  flag  FALSE 

Autopilot  engaged  TRUE 
AND  autopilot  flag  TRUE 

Autopilot  engaged  FALSE 
OR  autopilot  flag  FALSE 

State 

Output 
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Flight  director  OFF 
Yaw  damper  OFF 
Autopilot  OFF 
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of  view 
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Bias  flight  command  indicator  bars  out 
of  view,  yaw  damper  lighted,  yaw 
damper  enabled 
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Flight  director  ON 
Yaw  damper  ON 
Autopilot  OFF 
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Flight  director  lighted,  yaw  damper 
lighted,  yaw  damper  enabled 
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Flight  director  ON 
Yaw  damper  ON 
Autopilot  ON 
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Flight  director,  yaw  damper,  and  auto- 
pilot lighted;  yaw  damper,  autopilot 
enabled,  engage  autopilot  (control 
wheel  steering) 
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Flight  director  ON 
Yaw  damper  ON 
Autopilot  ON 
Control  wheel 
steering  ON 

0 

5 

3 

1 

ti> 

4 

1 

1 

1 

1 

3 

Flight  director,  yaw  damper,  and  auto- 
pilot lighted;  yaw  damper,  autopilot 
engaged,  disengage  autopilot  (control 
wheel  steering) 

1 

[!;>  Initiates  2.5-sec  fade-on  ramp  Flash  autopilot  four  times  and  sound  warning  horn 


Transition  mechanically  enforced,  flash  autopilot  four  Control  wheel  steering  alters  flight  director  output 

times  and  sound  warning  horn 


Because  the  mode  logic  for  this  basic  flight  control  system  is  done  entirely  by  the 
software,  no  corresponding  abstract-level  machine  is  necessary.  State  transition  tables 
are  well  suited  to  specifying  these  functions,  which  are  detailed  in  Reference  G-14. 
Figure  G-13  shows  the  structure  of  the  control  of  flow  functions.  The  switch  enables 
control  the  yaw  damper  and  autopilot  switches  through  holding  solenoids.  The  control 
laws  were  specified  by  traditional  control  engineers'  block  diagrams. 

The  description  of  specifications  by  the  state  transition  tables  of  finite-state  machines 
may  be  extended  to  more  complicated  flight  control  systems.  Those  functions  in  which 
the  flow  of  control  of  the  software  is  closely  connected  with  the  hardware  will  require 
two  levels  of  description. 

Specifications  may  be  written  in  a completely  formal  language  with  automatic  analysis  of 
syntax,  consistency,  and  completeness.  A notable  example  is  the  methodology  developed 
by  SRI-International  (ref  G-15).  However,  it  is  felt  that  the  ease  of  review,  change,  and 
communication  with  flight  control  engineers  afforded  by  the  state  transition  tables  more 
than  compensates  for  the  lack  of  automatic  aids. 


Figure  G-13.  Software  Flow  Control 


G-68 


G.2A.3  SOFTWARE  DESIGN  AND  CODE 


Hierarchy-plus-I/O  charts  adequately  express  the  software  design.  A partial  chart  is 
shown  in  Table  G-8.  The  consistency  of  the  I/O  relations  between  software  modules  may 
be  demonstrated  by  hand  or  machine  analysis.  The  software  is  designed  in  pseudocode 
without  concern  to  implementation,  whether  it  is  in  assembly  language  or  a high-order 
language.  The  transition  tables  for  the  finite-state  machines  are  easily  translated  into 
pseudocode. 

The  coding  from  the  hierarchy-plus-I/O  charts  is  straightforward.  If  the  specifications 
have  been  done  completely  and  precisely,  the  design  and  coding  flow  quickly.  The 
specifications,  design,  and  code  constitute  a package  of  documentation  that  is  relatively 
easy  to  understand  and  modify  because  there  is  close  correspondence  in  structure  between 
the  three  items. 

G.2AA  VERIFICATION  AND  VALIDATION 

The  approach  to  verification  and  validation  is  to  prove  that  the  control  of  flow  is  correct 
and  to  demonstrate  that  the  calculations  called  up  by  the  program  flow  are  correct.  For 
verification  of  the  software  design  or  code,  this  translates  into  establishing  groups  of 
relations: 

• The  transitions  and  outputs  of  the  finite-state  machines  for  system  control,  mode 
control,  signal  selection,  signal  monitoring,  redundancy  management,  and 
synchronization  are  correct. 

• The  computations  of  the  control  laws,  built-in  tests,  and  in-flight  self-tests  are 
correct. 

• The  data  and  filter  states  are  correctly  initialized,  and  all  state  variables  are 
preserved  to  the  next  computational  cycle. 

• The  rate  executive  structure  of  calling  the  software  modules  for  computation  is 
correct. 

• The  data  transfers  between  software  modules  are  correct. 
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Table  G-8.  Partial  Hierarchy-Plus-Input/Output  Chart 


Process  system  machine 

Input 

Process 

Output 

BIT  reports  OK, 
vertical  gyro  valid 

Flight  director  flag  -^-vertical  gyro  valid  AND  BIT  reports  OK 

Flight  director  flag 

Autopilot  state 

Flight  director 
button 

IF  flight  director  flag  = FALSE 
THEN  flight  director  state  "^OFF 
yaw  damper  state  OFF 
IF  autopilot  state  = ON 

THEN  autopilot  state  •<“OFF 
autopilot  warning  -<-0N 

IF  flight  director  button  = OFF 
THEN  flight  director  latch  ■<-OFF 

IF  flight  director  latch  = OFF  AND  flight  director  button  = ON  AND 
flight  director  flag  = TRUE 
THEN  flight  director  latch  '♦“ON 

IF  flight  director  state  = OFF  THEN  flight  director  state  -*-ON 
ELSE 

IF  autopilot  state  = OFF  THEN  flight  director  state  ■♦“OFF 

Flight  director  state 

Yaw  damper  state 

Autopilot  state 
Autopilot  warning 

Flight  director  latch 

Go-around  switch 

IF  go-around  switch  = ON  AND  flight  director  flag  = TRUE 
THEN 

IF  flight  director  state  = OFF  THEN  flight  director  state  ■♦“ON 
ELSE 

IF  autopilot  state  = ON  THEN  autopilot  state  •♦“  OFF 
Autopilot  warning  •♦“ON 

Control  wheel 
steering  switch 

IF  control  wheel  steering  = ON  AND  flight  director  flag  = TRUE 
THEN  control  wheel  steering  state  •♦“ON  flight  director  state 
•♦“ON 

IF  control  wheel  steering  state  = ON  AND  control  wheel  steering 
switch  = OFF 

THEN  control  wheel  steering  state  ■♦“OFF 
IF  autopilot  state  = ON 

THEN  autopilot  fader  = ON 

Control  wheel 
steering  state 

Autopilot  fader 

For  the  simple  flight  control  system  used  as  the  example,  a systematic  test  procedure  is 
feasible  for  exhaustively  testing  each  of  these  five  groups.  However,  the  finite-state 
machine  structure  may  be  demonstrated  with  confidence  by  analytical  means;  data 
initialization  and  transfers  may  be  shown  to  be  correct  by  careful  tabulations,  and  the 
control  laws  may  be  demonstrated  by  frequency  response  on  a simulation.  An  automated 
procedure  may  be  set  up  to  check  the  transitions  of  all  the  machines. 

The  validation  of  the  total  system  performance  may  follow  much  of  this  outline.  The 
global  consistency  of  the  self-testing  and  redundancy  management  facilities  is  more 
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difficult  to  demonstrate.  It  should  be  possible  to  model  these  functions  as  finite-state 
machines  and  perform  a systematic  analysis  for  normal  operation  and  for  classes  of 
hypothetical  hardware  failures. 

G.2.4.5  CONCLUSIONS 

In  the  preceding  paragraphs,  it  has  been  stated  that  flight  controls  have  a regular 
structure  that  can  be  used  as  the  basis  for  specification,  design,  coding,  verification,  and 
validation.  Many  variants  of  a systematic  methodology  can  be  shaped  about  this 
structure.  It  will  be  possible  to  develop  flight  control  software  that  is  certifiably  free  of 
technical  software  errors  and  performs  according  to  precisely  defined  specifications. 
Determining  the  system  response  to  all  possible  hardware  failures  depends  on  how  well  the 
models  of  faults  determined  from  failure  effects  and  modes  analysis  actually  represent  all 
the  possible  failures.  However,  experience  with  digital  flight  control  systems  is 
accumulating,  and  by  1990  we  shall  have  complete  confidence  in  our  analysis. 

Elaborate  software  tools  and  development  benches  are  useful  in  speeding  the  development 
process;  they  are  not  essential  in  providing  certifiable  flight  control  software. 
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G.3.0  THREE  SYSTEM  CONFIGURATIONS  FOR  1990 


G.3.1  INTRODUCTION 

Three  different  system  configurations  that  were  developed  are  characterized  as  being  of 
low,  medium,  and  high  risk.  These  three  alternatives  were  formulated  so  that  a single 
alternative  could  be  identified  with  an  awareness  of  the  likelihood  of  the  implementation 
being  advanced  in  concept  and  realizable  by  1990. 

The  low-risk  system,  described  in  Subsection  G.3.2,  follows  the  path  of  the  developments 
of  the  1970s  in  that  redundant  computers  are  run  in  a macrosynchronized  manner.  Data 
are  exchanged  between  the  redundant  computers  via  a dedicated  serial  bus.  Bit  for  bit, 
all  computations  are  identical  between  computers  as  a result  of  the  redundancy 
management  used  and  the  data  exchange  qualities.  Sensor  and  servo  interfaces  are 
predominantly  analog.  Only  minor  integrated  circuit  advances  are  required  for  this 
implementation. 

The  medium-risk  system,  covered  in  Subsection  G.3.3,  is  characterized  by  the  use  of 
multiple  microcomputers  in  each  computing  channel,  the  extensive  use  of  busing  for  both 
sensor  and  actuator  interfaces,  and  asynchronous  operation  between  computing  channels. 
An  increased  number  of  success  paths  for  greater  flight  safety  and  dispatch  reliability  and 
a reduction  in  software  preparation  costs  are  expected  in  this  system. 

Section  G.3.4  reviews  the  fault-tolerant  multiple  processor  (FTMP)  and  software- 
implemented  fault-tolerance  (SIFT)  architectures.  The  high-risk  system  has  certain 
similarities  to  these  architectures.  Busing  is  well  advanced  when  compared  to  the 
medium-risk  system. 


G.3.2  LOW-RISK  SYSTEM  FOR  1990 
G.3.2. 1 SYSTEM  ARCHITECTURE 

The  low-risk  system  is  based  on  principles  of  digital  fly-by-wire  (FBW)  control  developed 
over  the  last  10  years.  The  extrapolation  to  the  1990  time  frame  includes  a projection  of 
only  moderate  technology  growth  in  large-scale  integrated  circuits. 
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The  system  is  an  integrated  one  in  the  sense  that  the  crucial  FBW  and  short-period  pitch- 
augmentation  functions  are  accomplished  by  the  same  computer  set  as  the  critical 
augmentation  functions.  Sensors  and  servos  are  used  for  various  functions,  as  required  by 
the  control  laws. 

Pitch  axis  FBW  control  is  implemented  because  the  aircraft  could  not  be  flown  with 
mechanical  primary  flight  controls  alone.  Short-period  pitch-augmented  stability  (PAS)  is 
required  for  safe  flight.  Minor  additions  to  the  crucial  PAS  are  required  to  achieve  the 
FBW-PAS  combination.  In  this  instance,  improvements  in  cost,  weight,  reliability,  and 
maintainability  are  a result  of  FBW  control. 

The  hydromechanical  primary  flight  control  system  is  the  same  as  it  was  in  the  Baseline 
Configuration  for  the  roll  and  yaw  axes.  Although  FBW  control  also  may  be  advantageous 
in  these  axes,  safe  flight  does  not  require  stability  augmentation  as  is  the  case  in  pitch 
augmentation. 

Figure  G-14  shows  the  low-risk  Active  Controls  Technology  (ACT)  system  architecture. 
Quadruple  ACT  computers  develop  servocorhmands  based  on  quadruple  or  triple  sensor 
inputs.  The  computers,  also  interface  with  the  ACT  display  and  control  panel,  the  caution 
and  warning  system,  and  the  caution  and  warning  discrete  display. 

The  interfaces  between  the  ACT  and  the  digital  air  data  computer  (DADC)  and  the 
inertial  reference  system  (IRS)  are  Aeronautical  Radio  Incorporated  (ARINC)  429  type 
serial  buses.  ARINC  429  buses  also  are  used  to  interface  with  each  of  the  ACT  display 
and  control  panels,  the  caution  and  warning  system,  and  the  caution  and  warning  discrete 
display. 

The  ACT  interfaces  with  the  other  sensors  are  analog.  These  sensors  are  powered  by  the 
ACT  computer.  Signals  from  the  sensors  are  returned  to  the  computer  for  signal 
conditioning  via  dedicated  aircraft  wiring. 

The  servo-loop  electronics  are  contained  within  the  ACT  computer  in  each  case.  The 
servoamplifier  output  is  fed  to  each  servovalve,  and  feedback  sensor  signals  are  returned 
to  the  computer.  The  servoengage  solenoids  are  powered  from  the  computer. 
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The  computers  are  frame  synchronized  (i.e.,  each  minor  cycle  of  computation  is  initiated 
at  the  same  time  by  all  operable  computers  as  a result  of  the  halt-release  implementation 
used),  thus  eliminating  time  skew  in  the  sensor  input  and  servo  output  data.  Sensor  data 
are  exchanged  and  monitored,  and  signals  are  selected  for  each  parameter  so  that  control 
law  computations  are  identical  in  each  control  channel.  Fault  detection  is  enhanced,  and 
the  requirement  for  channel  equalization  is  avoided. 

G.3.2.2  REDUNDANCY  MANAGEMENT 

As  shown  in  Figure  G-15,  four  channels  of  computing  interface  with  four  channels  of 
crucial  sensors  to  provide  two  fail-operational  controls  for  the  crucial  FEW  and  short- 
period  PAS  systems.  A combination  of  comparison  monitoring  and  built-in  testing  is  used 
for  fault  detection  and  correction. 


Critical  Crucial 

sensors  sensors  Computer  A 


Figure  G-15.  Sensor,  Computer,  and  Servo  Interfaces 
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Each  computer  includes  both  analog  and  digital  electronics  as  required  for  power  supplies, 
input/output  (I/O),  sensor  processing,  digital  computing,  and  sufficient  analog  electronics 
for  reversion  to  an  analog  mode  under  certain  failure  states.  Data  exchange  between 
channels  is  via  a serial  link,  which  greatly  simplifies  aircraft  wiring  and  related 
redundancy  management. 

Sensors  associated  with  critical  functions  are  triplicated  and  fed  to  the  four  computer 
channels  in  the  manner  shown  in  Figure  G-15. 

G.3.2.2.1  Computers 

With  no  failures,  each  computer  comparison  monitors  all  sensor  inputs,  using  the  median 
of  the  A,  B,  C,  and  D sensors  for  subsequent  control  computations.  Each  computer, 
therefore,  uses  identical  input  data.  Because  the  computers  are  synchronized,  the  output 
command  servo  signals  are  identical,  permitting  bit-by-bit  comparison  monitoring  of  the 
outputs.  This  output  monitoring  is  the  primary  failure  detection  and  isolation  means  for 
first  computer  failures.  Because  normal  servocommand  signals  are  identical,  redundant 
servo  tracking  errors  are  only  due  to  tolerances  or  failures  in  the  servo  loops  themselves. 
With  the  precise  monitoring  implicit  in  comparing  identical  outputs,  failure  detection  for 
the  computers  is  thorough.  Furthermore,  any  divergence  tendencies  of  redundant  control 
law  integrations  are  avoided  with  the  macrosynchronized  computers. 

A second  computer  fault  can  be  isolated  by  comparison  monitoring  techniques.  Three 
computers  were  operating  prior  to  the  failure. 

A third  computer  failure  results  in  a miscompare  that  can  be  isolated  only  by  inline  self- 
test routines.  The  critical  flight  control  functions  are  disengaged,  and  this  failure  state 
is  indicated  on  the  fault  annunciator  panels.  To  isolate  third  computer  failures  so  that 
crucial  control  functions  are  maintained,  inline  self-test  routines  are  continually  run  by 
each  computer.  The  tests  verify  power-supply  voltages,  processor  memory  function,  and 
I/O  execution.  If  a self-test  is  not  successful,  a watchdog  timer  for  the  faulty  unit  will 
not  be  reset  to  initiate  the  next  computation  cycle  because  this  disables  the  computer  and 
disrupts  a validity  signal  to  the  other  computer. 
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G.3.2.2.2  Sensors 


If  a first  quadruple  sensor  fails  in  A,  B,  C,  or  D,  the  failed  unit  will  be  detected  by 
majority  vote  and  disabled  by  its  associated  computer.  Following  the  first  failure  of  a 
triplex  sensor  set,  or  the  second  quadruple  sensor  failure,  further  control  computations 
will  use  an  average  of  the  two  remaining  sensors. 

A subsequent  sensor  failure  of  a given  type  is  detected  by  comparison  monitoring.  Upon 
detection  of  a failure  of  one  of  two  sensors  by  comparison  monitoring,  the  action  taken 
will  vary  with  sensor  type. 

The  control  position  transducers  are  linear  variable  differential  transformers  (LVDT)  that 
have  center-tapped  secondary  signals  available  as  outputs;  the  center  tap  is  grounded. 
The  desired  displacement  signal  is  the  difference  between  voltages  appearing  at  the  other 
two  output  leads.  The  sum  of  these  voltages  is  roughly  a constant,  independent  of 
transducer  input  position  for  a properly  operating  device.  Upon  loss  of  excitation  or  any 
transducer  failure,  the  summation  voltage  will  significantly  change,  usually  falling  to 
zero.  By  monitoring  this  voltage,  second  control  position  transducer  faults  can  be  readily 
isolated  to  the  failed  transducer. 

Four  pitch-rate  signals  are  provided.  Three  are  taken  from  the  triple  IRS;  the  fourth  is 
from  a separate  sensor.  The  pitch-rate  signals,  whether  from  the  IRS  or  from  the  fourth 
separate  rate  gyro,  can  be  monitored  by  certain  techniques,  but  only  70%  of  the  failures 
can  be  isolated.  Certain  analytical  redundancy  techniques  are  available  from  either  of 
two  sources  to  improve  the  capability  to  select  a good  pitch-rate  signal.  The  two 
techniques,  however,  do  not  compare.  Other  sensors  are  not  crucial,  so  no  attempt  is 
made  to  isolate  a failure  between  two  that  miscompare.  The  function  associated  with 
those  sensors  is  disabled. 

G.3.2.2.3  Servoactuators 

Each  computer  provides  servo-loop  closure  electronics  for  specific  servoactuators.  The 
servos  are  also  monitored  by  the  computers  that  drive  them. 
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The  nature  of  the  servo  interface  depends  on  the  servoactuator  selected.  Alternative 
actuation  concepts  are  discussed  in  Subsection  G.4.2,  independent  of  the  system 
architecture. 

G.3.2.2.4  Analog  Reversion  Mode  Description 

The  analog  reversion  (AR)  mode  is  block  diagrammed  in  Figure  G-16.  With  AR,  aircraft 
can  still  be  landed  safely  after  a series  of  digital  computing  failures. 

The  AR  mode  is  engaged  in  one  of  two  ways.  If  the  FBW  system  reaches  a failure  state 
where  no  digital  success  paths  remain,  the  logic  will  automatically  engage  the  AR  mode. 
In  addition,  an  AR  engage  switch  enables  the  pilot  to  command  engagement  of  the  AR 
mode  any  time. 

With  the  AR  mode,  the  simplest  relationship  exists  between  sensors  and  surface  motions 
that  will  allow  safe  flight.  Level  3 handling  qualities  of  MIL-F-8785  are  deemed 
adequate.  The  sensors  are  those  required  for  the  pitch  axis  FBW  and  crucial  PAS  control 
systems.  The  same  elevator  servoactuators  are  driven. 

If  the  pitch  axis  requires  forward-loop  integration  for  satisfactory  control,  these' 
integrators  must  be  equalized  to  prevent  a divergence  of  the  computing  channels.  The 
midvalue  logic  circuit,  as  well  as  the  limited  error  feedback  signal,  equalizes  the 
integrators.  Prior  to  engagement  of  the  AR  mode,  the  integrators  synchronize  the 
computing  circuit  outputs,  resulting  in  transient-free  engagement  of  the  pitch  axis  of  the 
AR  mode. 

All  four  channels  of  the  AR  mode  are  engaged  at  once.  The  only  monitoring  and  fault 
correction  logic  provided  is  that  inherent  in  the  servoactuators.  This  imposes  an  added 
constraint  on  the  servoactuator  concept  to  be  chosen. 

G.3.2.3  ACT  COMPUTER 

Figure  G-17  is  a functional  block  diagram  of  the  ACT  computer,  including  preliminary 
functional  partitioning  to  the  card  level. 
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Figure  G-16.  Low-Risk  Approach  Functional  Block  Diagram  (Showing  Analog  Reversion  Mode) 
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Figure  G-17.  ACT  Computer  Block  Diagram 


G.3.2.3.1  Digital  Processing  Function 

The  digital  processing  function  of  the  ACT  computer  is  accomplished  by  the  central 
processing  unit  (CPU),  memory,  and  logic  1 and  logic  2 subassemblies.  The  memory 
subassembly  provides  32K  words  of  16  bits-per-word  (bpw)  fast-access  memory.  There  are 
28K  words  that  are  erasable,  programmable,  read-only  memory  (ROM),  and  4K  words  that 
are  random-access  memory  (RAM).  The  memory  address  logic  is  designed  so  that  a 
second  memory  subassembly  could  be  added  to  expand  the  memory  to  64K  words. 
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The  logic  1 and  2 subassemblies  provide  the  logic  and  timing  circuitry  for: 

• Memory  parity  generation  and  checking 

• Priority  interrupts  with  automatic  vectoring 

• Real-time  counter 

• Synchronization  hardware 

• Direct  memory  access  (DMA)  priority  logic 

• DMA  controller 

G.3.2.3,2  Input/Output 

The  entire  I/O  function  of  the  ACT  computer  is  under  DMA  control.  All  I/O  addressing 
and  logic  control  functions  are  accomplished  via  a programmable  DMA  controller. 

The  DMA  controller  determines  what  information  is  desired  by  decoding  a command  from 
the  CPU  and  generates  all  timing  and  control  signals  needed  to  manipulate  data  to  or 
from  memory  to  outside  the  system.  All  the  system  analog  inputs  and  outputs,  discrete 
inputs  and  outputs,  intercom  inputs  and  outputs,  and  other  data  of  a packed-word  format 
are  taken  from  or  stored  into  the  channel  memory  under  DMA  by  the  processor-controlled 
DMA  controller. 

The  DMA  controller  is  semi-free-running.  The  CPU  software  determines  when  it  needs 
data  brought  into  memory  for  the  computations  that  follow.  The  processor  command  to 
the  I/O  controller  points  to  the  memory  location  where  the  first  datum  is  to  be  stored, 
and  the  processor  indicates  how  many  consecutive  words  of  information  should  be  acted 
upon.  The  processor  can  request  that  from  1 to  128  consecutive  locations  be  accessed. 
Whether  they  are  inputs  or  outputs  is  defined  within  the  controller.  Upon  receiving  the 
command,  the  DMA  controller  starts  and  continues  on  to  completion  of  the  block  of  I/O 
operations  desired.  When  this  is  complete,  it  waits  for  a new  command. 

G.3.2.3.3  Intercom 

Digital  data  among  the  four  ACT  computers  are  exchanged  via  DMA  control  by  the 
interchannel  intercom  subassembly.  This  is  a serial  interface  whereby  each  transmitter 
provides  a data  line  and  a clock  line  to  each  of  the  other  three  computers.  The  data  shift 
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rate  is  1 MHz,  and  all  lines  are  differentially  driven,  twisted  pairs.  The  data  words  are 
time-slot  identified  and  consist  of  16  bits  plus  parity.  In  addition  to  using  cooperative, 
fixed  data  exchange  between  computers  for  self-test,  the  intercom  interface  permits  an 
internal  wraparound  test  for  fault  isolation. 

G.3.2.3.4  Discrete  Outputs 

The  discrete  output  subassembly  provides  the  capability  for  up  to  thirty-two  28V  outputs. 
The  outputs  are  addressed  as  four  8-bit  words.  Critical  discrete  outputs  will  be  monitored 
by  wraparound  to  the  discrete  input  subassembly. 

G.3.2.3.5  Discrete  Inputs 

The  discrete  input  subassembly  accepts  64  discretes.  They  are  accessed  as  8-bit  words 
and  are  used  for  three  different  functions;  wraparound,  internal,  and  external  discretes. 
The  wraparounds  enable  testing  of  discrete  outputs,  and  the  internal  discretes  provide 
status  and  test  results  required  for  various  self-test  functions.  All  accept  inputs.  Self- 
test stimulation  of  all  the  discrete  inputs  to  either  logical  one  or  logical  zero  is  possible 
regardless  of  the  state  of  the  actual  input  discretes. 

G.3.2.3.6  Analog  Outputs 

The  digital-to-analog  (D/A)  and  sample-and-hold  (S/H)  subassembly  contains  a 12-bit  (11 
bits  plus  sign)  D/A  converter  that  provides  a +10V  dc  range  output  signal  for  multiplexing 
to  the  S/H  outputs.  Up  to  24  outputs  can  be  accommodated. 

The  current  mode  drivers  for  the  servoactuator  electrohydraulic  valves  and  the  required 
failure  and  analog  reversion  mode  switching  for  the  servoactuators  are  contained  on  the 
two  servodrive  and  logic  subassemblies. 

The  AR  and  miscellaneous  output  subassembly  contains  the  dedicated  analog  signal 
circuitry  necessary  to  generate  the  servo  position  commands  for  the  AR  mode. 
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G.3.2.3.7  Analog  Inputs 


The  analog  input  conversion  is  implemented  by  the  demodulator,  dc  input  and  dc 
multiplexer,  and  analog-to-digital  (A/D)  converter  subassemblies. 

Each  demodulator  subassembly  has  22  synchronous  demodulators  that  are  multiplexed  to 
the  dc  multiplexer  and  A/D  subassembly. 

The  dc  input  subassembly  provides  for  buffering,  scaling,  and  analog  switching  of  32 
differential  dc  input  signals  to  the  dc  multiplexer  and  A/D  subassembly. 

The  dc  multiplexer  and  A/D  subassembly  enables  switching  of  96  dc  inputs  to  the  A/D 
converter. 

G.3.2.4  RELIABILITY  ASSESSMENT 

The  preliminary  failure  probability  assessment  for  the  low-risk  system  considered  only  the 
aircraft  flight  safety  as  affected  by  the  crucial  sensors  and  computers.  Servo  failure 
probabilities  were  neglected. 

Table  G-9  shows  the  failure  probabilities  used  in  the  assessment.  Results  of  the 
assessment  showed  that  the  probability  of  failure  in  a 1-hr  flight  for  crucial  ACT 
functions  was: 

• With  four  channels  operative,  3.8  x 10“^^ 

O 

• Dispatch  with  three  channels  operative,  1.29  x 10" 


Table  G-9.  Failure  ProbabiUties-^1990 


Element 

Failure  rate 
(per  million  hr) 

Symbol 

Self-test 

confidence 

Laser  gyro 

30 

0.68 

Flight  control  gyro 

30 

0.68 

Column  sensor 

3 

mm 

1.00 

Computer 

150 

0.95 
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Servo  failure  rates  were  not  included. 


These  results  indicate  that  the  low-risk  ACT  is  a viable  system;  however,  airplane 
dispatch  with  only  three  channels  operative  would  not  be  permitted. 

G.3.3  MEDIUM-RISK  SYSTEM 

An  lAAC  medium-risk  flight  control  system  can  be  constructed  using  projections  for 
component  and  software  technologies  that  have  a reasonable  probability  of  being  available 
by  1990.  A diagram  of  the  medium-risk  system  is  shown  in  Figure  G-18.  The  features  of 
this  system  are  summarized  in  the  following  subsections. 

G.3.3. 1 SENSORS 

The  medium-risk  sensor  concepts  are  based  on  a combination  of  existing  hardware  and 
advanced  software  techniques  used  to  minimize  cost  of  ownership. 

Triple  outputs  from  the  IRS  laser  gyros  will  be  used  for  the  primary  source  of  pitch  rate 
(q)  and  the  entire  source  of  yaw  rate  (r).  Roll  attitude  ( 0 ) is  also  taken  from  the  IRS 
output  in  triplicate.  Taking  the  outputs  directly  from  the  sensor  instead  of  from  the  IRS 
output  terminals  increases  the  reliability  of  the  q and  r sources;  i.e.,  20  000-hr  mean  time 
between  failures  (MTBF)  as  opposed  to  2400  hr.  The  crucial  flight  control  system 
specification  requires  either  more  sources  for  pitch  rate  or  some  alternate  way  of 
achieving  stable  pitch  control.  Both  solutions  are  achieved  in  effect  with  a software 
Luenberger  observer,  which  uses  normal  acceleration  to  derive  pitch  rate  when  the  IRS 
laser  gyros  have  failed. 

Three-axis  FBW  implementation  is  used  with  quadruply  redundant  pitch  and  roll  command 
LVDT  transducers  on  the  pilot  yoke  and  pedal  quadruple  LVDTs  for  yaw  inputs. 

G.3.3.2  COMPUTER  AND  SYSTEM  ARCHITECTURE 

The  medium-risk  system  architecture  is  based  on  emerging  technologies  in  micro- 
processors, data  bus  and  bus  control  logic  capabilities,  and  advanced  failure  management 
techniques. 
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Figure  G- 18.  lAAC  1990  Medium-Risk  System 


G.3.3.2.1  Input  Data  Bus 


Input  data  buses  route  the  sensor  inputs  to  the  four  I/O  processors.  Three  of  the  four  are 
identical  in  that  they  carry  one  channel  of  the  triple  sensor  data  and  one  channel  of  the 
quadruple  sensor  data.  The  fourth  data  bus  contains  the  fourth  channel  sensor  data  plus 
an  extra  copy  of  all  crucial  IRS  sensor  data;  i.e.,  all  three  pitch-rate  and  normal 
acceleration  outputs.  The  key  issue  for  this  type  of  busing  is  throughput  versus  available 
bandwidth.  A rough  calculation  for  each  of  the  A,  B,  or  C buses  is: 

• The  15  sensors,  plus  6 discretes,  plus  k spares  = 25  signals 

• Each  slot  contains  12  bits  of  data  plus  13  bits  of  address  and  protocol  = 25  bits 

• Data  rate  = 512  Hz 

Therefore 

throughput  = 25  X 25  X 512  = 320K  bits  per  second  (bps) 

This  is  very  conservative  for  projected  bandwidths  of  IM  bps  for  standard  bus  hardware 
and  lOM  bps  for  fiber  optics.  The  512-Hz  rate  purposely  is  set  high  to  allow  asynchronous 
operations  for  all  channels. 

G.3.3.2.2  I/O  Processors 

Quadruple  I/O  processors  perform  basic  failure  management  on  the  four-channel  sensor 
data  coming  in.  Assuming  that  all  channels  are  identically  loaded  (the  D channel  has  a 
lower  load),  the  sensor  processor  must  accept  25  signals  at  512  Hz  from  each  of  four 
channels  or  51  200  words  per  second  (wps).  Using  a 4-sec  time  to  buffer  into  the 
processor  to  memory,  the  loading  operation  takes  about  20.4%  of  the  available  time. 

The  I/O  processor  performs  midvalue  selection  followed  by  comparison  monitoring  on  all 
triple  and  quadruple  sensors.  The  loading  for  this  is  approximately  200K  operations  per 
second  (ops),  which  is  considered  quite  feasible  by  1990.  This  estimate  allows  for  the 
pitch-rate  observer  discussed  in  Section  G.6.0. 
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G.3.3.2.3  Sensor  Electronics 


An  A/D  conversion  is  performed  on  each  sensor's  output  by  sensor  electronics  circuitry 
packaged  with  the  sensor  output  to  be  transmitted  in  serial  digital  form.  The  sensor  data 
are  output  to  the  input  data  buses  upon  command  from  the  bus  controller. 

The  I/O  processor  also  transmits  all  the  control  commands  to  the  output  data  buses  and 
performs  control  command  equalization.  These  commands  are  received  from  the  control 
law  processors  via  a DMA.  For  extra  failure  tolerance,  the  crucial  control  functions;  i.e., 
PAS  and  stick  commands,  are  processed  in  the  I/O  processors. 

G.3.3.2.4  Control  Law  Processor 

All  control  commands  are  calculated  in  the  control  law  processors  (CLP).  The  sensor 
information  is  transmitted  to  the  CLP  via  the  shared  memory.  Using  the  Initial  ACT 
Configuration  loading  figures,  the  CLP  operates  at  approximately  260K  ops. 

G.3.3.2.5  Output  Data  Buses 

Quadruple  output  buses  transmit  all  the  control  commands  to  the  servo  inputs,  and  all 
servo  information  used  in  servo  failure  management  is  transmitted  to  the  output  monitor 
processor  by  way  of  these  buses.  The  throughput  for  this  (assuming  256-Hz  data 
transmission)  is  estimated  at  bps. 

G.3.3.2.6  Output  Monitor  Processors 

The  output  monitor  processor  performs  downstream  checks  on  control  command  validity 
coming  from  the  I/O  processors  and  failure  management  for  the  servos.  The  unique 
feature  of  this  processor  is  that  it  is  not  in  the  control  loop;  therefore,  a time  delay  is 
eliminated.  Its  function  is  failure  management  exclusively.  The  output  monitor 
processor: 

• Switches  bus  routes  to  the  servos 

• Monitors  servos 

• Shuts  down  servos 

• Shuts  down  upstream  computers 


G-88 


The  loading  is  estimated  at  160K  ops. 


G.3.3.3  FAILURE  MANAGEMENT  FOR  THE  MEDIUM-RISK  SYSTEM 

Figure  G-19  shows  a simplified  failure  management  diagram.  Because  the  diagram 
emphasizes  the  crucial  functions,  quadrupiy  redundant  sensors  (as  exemplified  by  the  pilot 
control  position  transducers)  are  shown.  Triplex  servos,  as  used  for  elevator  control,  also 
are  shown. 


Each  sensor  output  is  assigned  to  one  of  the  four  "input  data  buses."  Data  from  all  four 
input  data  buses  are  fed  to  each  ACT  computer.  Periodically,  the  corresponding  sensor 
signals  are  compared  to  one  another  and  the  midvalue  of  the  signals  is  determined.  The 
comparison  monitoring  detects  a sensor  failure.  Once  a sensor  has  been  determined  to 
have  failed,  the  signal  selection  and  monitoring  proceeds,  using  the  remaining  operative 
sensors. 


Figure  G-19.  Simplified  Failure  Management  Diagram 
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The  midvalue  of  each  set  of  sensor  signals  is  then  used  in  the  control  law  computation. 
The  servoactuator  position  commands  so  determined  are  output  on  the  output  data  buses. 
Each  of  the  four  ACT  computers  outputs  its  servocommands  on  one  of  the  four  output 
data  buses. 

The  output  monitor  processor  has  access  to  the  servocommands  transmitted  by  all  four  of 
the  ACT  computers  on  the  output  data  buses.  The  output  monitor  processor  compares  the 
corresponding  commands  and  determines  any  failure  that  may  have  occurred  in  the  ACT 
computer  or  output  buses.  It  will  correct  for  first  failures  of  the  servocommands  by  bus 
switching  between  the  output  data  buses  and  servocommand  buses,  as  indicated  in 
Figure  G-19.  Subsequent  failures  are  corrected  by  disabling  servoactuator  channels. 

The  monitor  processor  also  monitors  each  servoactuator  channel.  Signals  necessary  to 
allow  such  monitoring  are  fed  back  from  the  servos  via  the  output  data  buses.  A 
servoactuator  channel  is  disabled  by  a monitor  processor  by  means  of  a communication  via 
the  output  data  and  servocommand  buses. 

Triplex  sensor  signals  for  the  critical  functions  are  handled  in  the  same  manner  as  the 
quadruple  signals  except  that  no  signal  appears  on  the  D input  data  bus.  All  action  is  the 
same  as  the  quadruple  sensor  case  after  the  D sensor  has  failed. 

The  exception  to  this  is  the  treatment  of  the  IRS  pitch-rate  and  normal  acceleration 
signals.  Here,  each  of  these  signals  is  applied  to  the  D input  data  bus  as  well  as  to  one  of 
the  A,  B,  or  C buses.  Upon  experiencing  a second  pitch-rate  signal  failure,  an  estimated 
pitch-rate  signal  derived  primarily  from  the  normal  acceleration  feedback  is  used  for 
continued  control.  The  manner  of  accomplishing  this  advanced  form  of  failure  tolerance 
is  described  in  Section  G.6.0. 

G.3.3.4  RELIABILITY  ASSESSMENT 

Table  G-10  shows  the  failure  rates  used  in  the  preliminary  reliability  assessment  for  the 
medium-risk  system.  Table  G-11  shows  the  results  of  the  assessment. 

It  is  concluded  that  the  reliability  is  comfortably  in  excess  of  that  required  for  the  crucial 
functions.  Dispatch  with  certain  failed  elements  could  be  safely  allowed. 
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Table  G-10.  Component  Failure  Rates 


Element 

Failure  probability  for  1 flight  hour  (x  10  ) 

Comments 

Self-test  coverage 

1980 

1990 

percent  (1990) 

Pitch-rate  gyro 

30 

20 

Laser  gyro 

68  (95) 

Accelerometers, 

25 

20 

- 

Position  transducer 

7 

5 

LVDT  type 

100 

Servocurrent  sensors 

1 

1 

Resistor  network 

- 

Sensor  output  chip 

- 

5 

Including  output 
processing  protocol 

— 

One  bus  and  serial/parallel 

20 

7 

- 

Sensor  processor 

150 

50 

I/O  CPU  memory 

95  (99) 

C-L  processor 

150 

50 

I/O  CPU  memory 

95  (99) 

Monitor  process  and  logic 

170 

55 

I/O  CPU  memory 

95 

Critical  sensors 

35 

25 

(100)* 

* Assuming  paired  accelerometers 


Table  G-11.  Medium-Risk  System  Reliability  Analysis 
(Crucial  Functions  Only) 


Equipment 

Failure  probability  for  1 flight  hour 

Fault  free 

1 faulty  element  (dispatch) 

Sensors 

• Column  LVDT  (including 
bus  interface) 

• g (including  bus  interface) 

< 10*^^ 
< 10*^^ 

4.3  X 10’''° 

(95%  LVDT  self-test) 

4.3  X 10'''° 

Computer 

• I/O  processors  (processor 
and  bus) 

< 10*^2 

4.0  X lO'’® 
(95%  self-test) 
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G.3A  HIGH-RISK  SYSTEM 


Central  to  the  problem  of  suggesting  an  advanced  architecture  for  an  ultrareliable  flight 
control  system  in  1990  is  the  prediction  of  what  microelectronic  circuitry  will  be 
available  at  that  time.  The  prototypes  of  two  current  research  systems  for  flight 
controls,  FTMP  (refs  G-16  and  G-17)  and  SIFT  (ref  G-18),  are  implemented  in  state-of- 
the-art  hardware.  While  advances  in  electronic  technology  will  help  reduce  cost  and 
improve  characteristics,  these  systems  are  not  directed  at  incorporating  trends  in  circuits 
in  any  fundamental  way.  FTMP  uses  massive  hardware  redundancy.  The  design  isolates 
functions  to  facilitate  fault  containment  and  functional  replacement;  it  will  be  difficult 
to  use  the  trend  to  integration.  The  SIFT  design  is  relatively  independent  of  the 
hardware.  It  relies  on  software  to  manage  redundant  facilities  and  is  a general-purpose 
computing  system.  The  approach  taken  by  Jet  Propulsion  Laboratory  (JPL)  (ref  G-19)  is 
to  outline  an  architecture  that  anticipates  advances  in  electronics.  They  plan  to  be  in  a 
position  to  use  the  new  circuits  in  a fundamental  manner  as  they  become  available, 
without  making  a completely  new  departure  in  system  architecture  for  each  innovation. 
While  a difficult  task,  this  is  more  in  line  with  the  purpose  of  studying  a high-risk 
architecture.  We  will  modify  the  JPL  approach,  which  is  directed  at  very-long-life  space 
probes,  to  fit  ultrareliable  flight  controls. 

G.3.4.1  FAULT-TOLERANT  MULTIPLE  PROCESSOR  AND  SOFTWARE-IMPLEMENTED 
FAULT  TOLERANCE 

The  FTMP  configuration  is  shown  in  Figure  G-20.  Two  internal  buses  are  diagrammed,  but 
the  clock  bus  for  producing  and  distributing  the  totally  synchronized  clock  signal  is  not 
shown.  All  elements  are  synchronized  by  a massively  redundant  clock  structure.  Thus, 
there  are  six  separate  buses:  memory  access,  clock,  interprocessor-1,  interprocessor-2, 
input,  and  output. 

The  last  four  buses  are  grouped  in  the  diagram  as  the  interface  access  bus.  The  buses  are 
protected  from  faulty  elements  by  the  bus  guardians.  These  dual-redundant  units  also 
enforce  the  configuration  of  memory  and  processor  triads  and  select  which  of  the  multiple 
bus  wires  are  to  be  used  to  constitute  the  respective  buses.  The  intelligence  for  these 
allocations  is  by  software.  The  processors  and  memory  modules  are  dynamically  assigned 
to  triads  so  that  all  calculations  and  transactions  are  in  groups  of  three.  This  allows  each 
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Figure  G-20.  Fault-Tolerant  Multiple  Processor  Configuration 


bus  transmission  to  be  voted  upon  at  the  receiving  element.  The  triads  are  reconfigured 
upon  detecting  a failed  element.  This  is  the  major  level  of  redundancy  management; 
there  are  sublevels  of  bus  error  correction,  clock  element  replacement,  and  bus  wire 
assignment.  Inline  tests  are  used  to  detect  latent  failures  in  standby  elements. 

The  SIFT  configuration  (fig.  G-21)  determines  bus  or  processor  failures.  Redundancy  is 
managed  by  the  software  executives.  No  hardware  mechanisms  are  used  other  than  those 
embedded  in  the  standard  hardware.  A few  inline  tests  are  used  to  differentiate  between 
causes  of  failure  in  several  ambiguous  cases  not  handled  by  the  primary  diagnostic 
algorithm. 

G.3.4.2  MICROELECTRONICS  TRENDS 


The  following  paragraphs  review  the  points  that  help  justify  the  choice  of  a high-risk 
architecture.  As  in  any  prediction,  these  points  are  subjective.  Reference  G-11  is  an 
example  of  one  of  many  trend  surveys. 
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Figure  G-21.  Software- Implemented  Fault  Tolerance  Configuration 


a.  Most  faults  are  in  off-chip  connections— the  reliability  of  on-chip  circuits  is 
excellent.  With  wide  application  of  the  chip,  very-large-scale  integration  (VLSI) 
results  in  reliable  and  economical  circuits.  A flight  control  architecture  must  use  a 
small  number  of  universal  VLSI  circuits  to  reduce  the  number  of  interconnections. 

b.  Testing  problems  grow  exponentially  with  the  number  of  gates  in  a circuit.  In 
addition  to  circuit  complexity,  other  aspects  must  be  considered  to  establish  the 
importance  of  testing  on  circuit  design  and  applications.  There  are  two  major 
dimensions  to  testing:  (1)  the  level  of  component  assembly  (circuit,  macrocell,  chip, 
board,  and  system)  and  (2)  the  place  of  the  tests  in  the  life  cycle  (design 
verification,  chip  manufacture,  board  assembly,  system  assembly,  and  field  use). 
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The  field-use  period  has  several  divisions: 


• Preoperational  checkout 

• Normal  operations 

• Fault  isolation  to  the  line  replaceable  unit  (LRU) 

• Maintenance  testing  to  locate  faults  for  repair  of  the  LRU 

During  normal  operation,  there  are  self-tests  to  find  current  and  latent  faults, 
comparisons  of  redundant  facilities,  and  error-correcting  mechanisms  in  circuits  and 
codes.  Rather  than  adding  ad  hoc  provisions  for  each  of  these  items,  a more 
structured  approach  will  be  necessary  to  control  the  cost  of  testing  for  large  chips 
and  complicated  systems.  For  some  chips,  the  cost  of  testing  is  already  more  than 
the  cost  of  manufacturing. 

More  attention  will  be  placed  on  designing  circuits  so  that  they  can  be  economically 
and  easily  tested.  Because  circuitry  is  inexpensive,  overhead  costs  for  testing  are 
now  lower.  The  ultimate  level  of  self-test  is  shown  in  Figure  G-22.  Actual 
functions  are  duplicated  but  are  in  complementary  logic  to  avoid  material  or 
pattern-sensitive  faults.  Inputs  and  outputs  are  carried  by  redundant  error- 
detecting and  correcting  code.  Smaller,  totally  self -checking  circuits  are  possible. 
Even  at  more  than  100%  overhead  in  circuitry,  number-of-gates  growth  is  linear, 
while  testing  is  exponential. 

In  addition  to  making  VLSI  circuits  fault  tolerant,  testing  and  self-checking 
provisions  will  be  included  in  the  circuits  in  1990.  Our  architecture  should  take 
advantage  of  this;  the  FTMP  and  SIFT  designs  do  not  directly  look  to  these 
techniques  for  their  fault  handling. 

In  the  past,  computer  processing  throughput  was  limited,  which  required  computers 
to  be  synchronized  if  any  comparison  of  outputs,  even  by  analog,  was  to  be  made. 
With  higher  speeds,  synchronization  is  needed  only  for  precise  cross-channel 
comparison.  Hence,  unsynchronized  channels  with  final  comparisons  performed  as  in 
the  medium-risk  system  may  be  considered,  or  an  attempt  may  be  made  to  uncouple 


error  detection) 

Figure  G-22.  Self-Testing  Configuration 


each  channel  with  force-summing  actuators  receiving  the  final  outputs.  This  would 
require  that  the  computing  hardware  be  capable  of  100%  detection  of  critical  faults. 
Such  hardware  may  be  available  by  1990. 

d.  SIFT  reconfigures  buses  and  processors,  and  FTMP  goes  further  in  its  redundancy 
management.  By  1990,  the  more  reliable  hardware  should  provide  at  least  the  level 
of  confidence  of  SIFT  by  fault  isolation  to  the  channel.  This  will  avoid  complicated 
monitoring  and  difficulty  in  validating  the  system.  Fault  isolation  could  be  done  by 
cross-channel  voting  but  would  not  be  needed  if  the  hardware  is  100%  self-checking. 

HIGH-RISK  ARCHITECTURE 

If  the  foregoing  premises  apply,  the  self-checking  computer  module  shown  in  Figure  G-23 
can  be  considered.  This  is  modeled  after  the  JPL  approach  (ref  G-20).  All  circuits  except 
the  processors  and  the  memory  are  assumed  to  be  totally  self-checking.  The  processors 
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are  tightly  synchronized  and  run  the  same  programs  in  step  to  check  each  other. 
Processors  are  inexpensive,  and  any  standard  processor  may  be  used.  Without  the 
complicated  redundancy  management  and  software  self-tests,  there  is  adequate 
throughput  for  the  ACT  control  functions  and  signal  select  and  sensor  monitoring.  The 
processors  will  include  the  memories  by  1990.  The  memory  shown  in  Figure  G-23  is  coded 
for  error  detection  and  correction.  A tristate  internal  bus  carries  internal 
communications.  (Tristate  refers  to  the  three  levels  of  impedance  that  each  device 
presents  to  the  bus  depending  on  whether  the  signal  is  a 1,  a 0,  or  whether  the  device  is 
inactive.)  There  are  no  provisions  for  the  processors  of  one  module  to  exchange  data  with 
any  other  module. 


Figure  G-23.  Self-Checking  Computer  Module 
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The  memory  interface  allows  access  to  the  storage  array.  It  provides  code  correction  to 
damaged  memory  data,  replacement  of  a faulty  bit  plane  with  a spare,  parity  encoding 
and  decoding  to  the  internal  bus,  and  detection  of  faults  within  its  own  circuitry.  This 
element  requires  about  2000  gates. 

The  chip  for  the  bus  adapter  may  be  microprogrammed  to  work  as  the  bus  controller  or  as 
a remote  terminal.  The  controller  and  adapters  on  a particular  bus  operate  together 
autonomously.  The  bus  controller  reads  a control  table  from  the  memory  that  specifies 
the  source  and  destination  of  the  information  along  with  the  transmission  length.  It  then 
broadcasts  appropriate  commands  over  the  bus  system  to  bring  up  the  transmitting  and 
receiving  adapter  circuits  and  monitors  the  transfer  of  information,  records  status 
messages,  and  notifies  the  host  computer  upon  transfer  completion.  This  is  an 
unnecessarily  complicated  sequence  for  the  input  from  sensors  and  the  output  to  actuators 
for  flight  control;  however,  these  are  mass  produced,  which  results  in  features  directed  to 
a wider  audience. 

The  bus  adapter  chip  consists  of  five  elements  (ref  G-20):  a bus  interface  element,  a 
microprogram  control  unit,  a control  ROM,  a data  path  element,  and  a DMA  controller. 
The  bus  interface  element  translates  incoming  bus  signals  supplying  a bus-synchronized 
clock  and  data  signals.  It  also  accepts  data,  clocks,  and  signals  and  encodes  them  for  bus 
transmission.  The  microprogram  control  unit  provides  control  sequences.  A 

microprogram  location  counter  is  started  at  one  of  several  fixed  addresses  by  command  or 
data  synchronization  or  a host  processor  command.  The  location  counter  proceeds 
through  sequential  addresses  or  branches  on  the  basis  of  incoming  data,  internal  flags,  or 
other  internal  circuit  conditions.  A unique  set  of  address  sequences  is  produced  for  each 
type  of  incoming  bus  command,  data  sequence,  or  computer  command.  This  output 
sequence  is  then  mapped  through  a control  ROM  to  generate  the  detailed  control  signals 
required  to  drive  the  data  path,  microprogram  control  unit,  and  DMA  control  elements. 
The  control  ROM  maps  the  microprogram  address  sequence  into  control  signals  for  the 
various  circuits.  The  data  path  section  contains  registers  to  buffer  addresses  and  data;  a 
ROM  to  store  memory  protection  bounds,  data  keys,  and  table  addresses;  and  an 
arithmetic  logic  unit  for  addressing  computations.  This  circuit  is  similar  to  existing  bit- 
slice  processors,  with  the  exception  that  serial-parallel  conversion  registers,  ROM,  and 
several  holding  registers  are  required  for  the  unique  bus  interface  and  DMA  functions. 
The  DMA  control  circuit  is  responsible  for  obtaining  control  of  the  internal  bus  and 
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transferring  data  between  the  bus  adapter  and  the  memory.  The  fault  detection 
techniques  used  are  based  on  parity  coding  to  protect  memory  information  and  duplication 
with  morphic  comparison  for  most  of  the  logic  circuitry. 

The  core  compares  the  outputs  of  the  two  processors  for  disagreement,  encodes  the 
outputs  of  the  processors  for  transmission,  checks  parity  on  the  internal  bus,  allocates  the 
internal  bus  to  the  bus  adapters  and  controller,  detects  its  own  faults,  collects  fault 
indications  from  other  elements,  disables  the  module  output  under  error  conditions,  and 
halts  computation  on  recurring  faults. 

The  flight  control  system  comprises  four  of  these  self-checking  computing  modules  plus 
the  complements  of  sensors,  actuators,  and  power  supplies.  If  a module  detects  a failure, 
it  inhibits  its  output.  Presumably,  the  bus  controller,  if  not  at  fault,  would  continue  to 
call  for  the  appropriate  signals  from  the  sensors  so  they  would  be  available  to  other 
channels.  Massive  failures  that  overwhelm  the  error-detecting  codes  would  be  handled  by 
the  force-summed  actuators  and  their  related  circuitry.  Provisions  would  be  needed  so 
that  the  actuator  would  inhibit  an  offending  computer  module. 

G.3AA  SUMMARY 

The  high-risk  architecture  seeks  to  accommodate  the  following  premises: 

• High  reliability  will  be  obtained  by  integrating  circuitry  on  chip  and  by  minimizing 
connections  between  chips. 

• The  trend  toward  integration  makes  the  testing  problem  severe. 

• Future  designs  will  incorporate  much  more  substantial  provisions  for  testing,  self- 
checking, error  correction,  and  fault  tolerance. 

• The  reliability  of  microelectronics  in  1990  will  allow  asynchronous,  independent 
channel  operation. 

• The  software  of  autonomous  channels  is  simpler  than  systems  that  reconfigure  at 
lower  levels. 
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Bus  technology  is  the  key  issue,  and  whether  self-checking,  ultrareliable  bus 
adapters  and  controllers  will  be  available  in  1990  is  a major  consideration. 
Because  the  bus  is  the  central  issue  in  many  systems,  the  probability  that  they  will 
be  available  is  high. 
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G.4.0  SERVOACTUATOR  CONCEPTS  OF  lAAC 


The  actuators  that  would  interface  with  any  of  the  three  systems  (low,  medium,  and  high 
risk)  described  in  Section  G.3.0  and  the  selected  alternative,  described  in  Section  G.5.0, 
are  addressed  in  this  section.  Electromechanical  actuators  (EMA)  should  be  used  to  drive 
the  flaperons.  The  relative  ease  of  electric  power  transmission  across  the  flaperon  hinge 
line  was  the  motivating  factor  for  this  decision.  Subsection  G.4.1  describes  the  resulting 
EMA  design. 

Conventional  hydraulic  actuators  were  selected  for  control  of  other  surfaces. 
Subsection  G.4.2  describes  the  hydraulic  actuators  to  be  used  in  the  1990  Active  Controls 
Technology  (ACT)  system. 

G.4.1  FLAPERON  CONTROL  WITH  ELECTROMECHANICAL  ACTUATOR 

EMAs  drive  the  flaperons  for  the  1990  ACT  control  system.  EMAs  are  used  in  this 
application  because  of  the  ease  with  which  electric  power  can  be  transmitted  across  the 
wing-flap  interface  as  compared  with  the  hydraulic  power  alternative. 

G.4.1.1  ELECTROMECHANICAL  ACTUATOR  SYSTEM 

Flaperon  EMAs  are  shown  in  Figure  G-24.  The  performance  capability  conforms  to  the 
performance  requirements  in  all  respects.  The  EMA  is  composed  of  two  dual-wound, 
brushless,  permanent-magnet  (PM)  motors  whose  outputs  are  mechanically  summed  to  the 
output  through  a differential  gearing.  The  EMA  may  be  described  as  dual  channel 
mechanical  and  quadruple  channel  electric. 

The  EMA  system  for  each  flaperon  is  composed  of  an  actuator  and  two  servodrive 
electronics  units  (SDEU),  as  shown  in  Figure  G-25. 

Two  dual-wound,  torque-summed,  PM,  brushless,  270V  dc  motors  are  velocity  summed  in 
differential  compound  planetary  gearing  in  a hinge-line  rotary  actuator  mechanism.  Each 
motor  shaft  passes  through  a brake  assembly  that  is  spring-loaded  "on"  and  electrically 
powered  "off"  by  either  of  two  dual-solenoid  windings. 
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Design  characteristics 

• 0.76m  (30  in)  long,  0.1m  (4  in)  diameter 

• 22-kg  (48-lb)  actuator  assembly 

• Dual-dual  motors,  velocity  summed 

• Dual,  power  off,  braire 

• Passive  tfiermal  mass  temperature 
control 

• 270V  dc  power 

• 12A  (6  each)  at  stall 

• 1A  (0.5  each)  at  no-load  maximum 
rate 


Performance  capability 

• 4240-N-m  (37  500-in-lb)  minimum  stall 
torque  with  two  of  four  channels 

• 80-deg/s  no  load  with  two  motors 

• Capability  to  hold  stall  continuously 

• 40-rad/s  minimum  bandwidth 

• Two-channel  fault  tolerance 

• -^120°  to  -68°C  (-^250°  to  -90°F) 
operational  environment 


Figure  G-24.  Electromechanical  Flaperon  Hinge-Line  Actuator 


Figure  G-25.  Electromechanical  Actuator  Block  Diagram 
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Quadruple  surface  position  encoder  assemblies  are  embedded  in  the  actuator  housing 
assembly  to  reflect  compliance  and  to  avoid  the  need  of  reference  position  cycling. 

Four  identical  channels  of  servo  control  and  monitoring  electronics  are  contained  in  two 

identical  SDEUs.  Both  are  mounted  within  the  movable  flap  structure  with  only  redundant 

28V  dc  and  115V  ac  power  and  data  buses  bridging  the  flap-to-wing  structural  interface. 

•2  *2 

Each  SDEU  weighs  6 A kg  (14  lb)  and  has  a volume  of  9.4  x 10”  m (576  in).  Data  bus 
inputs  and  outputs  are  shown  in  Table  G-12. 

SDEUs  provide  resident  redundancy  management.  Fault  detection  is  based  on  proven 
comparison  monitoring  techniques  augmented  by  inline  monitoring  checks.  For  periodic 
ground  or  preflight  test,  built-in-test  (BIT)  routines  are  provided  to  be  initiated  by  the 
ACT  computer  command.  Thermal-limit  shutdown  is  provided  to  avoid  inadvertent  stress 
during  ground  operations. 


Table  G-12.  Servodrive  Electronics  Unit  Data  Bus  Words 


Inputs  from  FC  computer 

Outputs  to  FC  computer 

Status  commands 

Status  commands 

• On/off  command  channel  A (or  C) 

• On/off  status  channel  A (or  C) 

• On/off  command  channel  B (or  D) 

• On/off  status  channel  B (or  D) 

• Failure  reset  command  channel  A (or  C) 

• Surface  position  feedback 

• Failure  reset  command  channel  B (or  D) 

• RM  fail  status 

• Self-test  initiate  command 

• Fail/not  fail  channel  A (or  C) 

• Fail/not  fail  channel  B (or  D) 

Control  commands 

• Continuous  BIT  status 

• Surface  position  command  channel  A 
(orC) 

• Surface  position  command  channel  B 
(or  D) 



• SDEU  channel  A fail  (or  C) 

• SDEU  channel  B fail  (or  D) 

• Actuator  channel  A fail  (or  C) 

• Actuator  channel  B fail  (or  D) 

• 270V  dc  fail 

• 28V  dc  fail 
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Development  of  the  flaperon  actuator  (its  physical,  electric,  thermal,  and  dynamic 
characteristics)  is  based  on  a systematic  method  of  structured  modeling  and  on  hardware 
and  software  correlation  iteration  cycles.  Properly  applied,  this  methodology  optimizes 
many  performance  and  programmatic  variables  for  a particular  actuation  application  prior 
to  commitment  of  a design  to  hardware  production. 

Figure  G-26  is  an  analytical  block  diagram  of  the  flaperon  actuation  system.  Table  G-13 
identifies  system  parameters  that  have  been  or  need  to  be  identified. 

G.4.1.2  REDUNDANCY  MANAGEMENT 

The  flaperon  actuation  system  is  basically  quadruple  redundant.  Fault  detection  and 
reconfiguration  are  primarily  by  comparison  monitoring  of  the  servo  error  signals. 
Comparison  monitoring  is  augmented  by  inline  monitoring  of  the  control  electronics  and 
certain  motor-feedback  sensor  characteristics  to  improve  fault  detection  capabilities. 

Although  the  EMA  system  configuration  conceivably  would  allow  continued  operation 
after  the  failure  of  three  electric  channels,  this  is  not  planned  for  ACT  application.  At 
least  two  channels  of  drive  electronics  always  will  be  operative  or  the  EMA  will  be  shut 
down  and  braked. 

The  flaperon  actuation  combination  of  magnetic  torque  summing  with  velocity  gear-train 
summing  results  in  varied  tolerance  to  primary  string  faults.  Stall  torque  is  sized  for  any 
two  of  four  motor  windings  inoperative;  therefore,  with  no  faulted  windings,  twice  the 
stall  torque  would  be  available  if  not  intentionally  limited.  The  maximum  surface  no-load 
rate  is  produced  when  both  velocity-summed  motors  are  functional,  although  each  motor 
may  have  one  torque-summed  winding  inoperative.  If  one  velocity-summed  motor  is 
inoperative  and  its  brake  locked,  the  maximum  surface  rate  will  be  half  of  the  two-motor 
value,  but  the  full-stall  torque  capability  still  will  be  present.  These  fault-down 
characteristics  are  inherent  in  each  of  the  summing  types  used.  The  following  table 
summarizes  these  fault  effects. 


Fail  state 

One  motor  winding  open 

Two  windings  open;  one  each  motor 

Two  windings  open;  one  motor  braked 


Effect 

None;  full  torque  and  rate 
Half  torque,  full  rate 
Half  rate,  full  torque 
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Table  G-13.  Electromechanical  Actuator  Parameters  and  Variables, 
Flaperon  Application 


SYMBOL 

UALUE 

UNITS 

DESCRIPTION 

KT 

* 

FT_LB/AMP. MOTOR  TORQUE  GAIN 

TI 

.001 

SEC 

CURRENT  SOURCE  TIME  CONSTANT 

KE 

% 

U/<R/S) 

BACK  EMF  CONSTANT 

NOl »N02 

2f2 

NUMBER  OF  MOTORS  TORQUE  SUMMED  (MAX) 

ILIM 

% 

AMP 

CURRENT  LIMIT 

TMAX 

% 

FT-LB 

MAX  TORQUE  PER  WINDING 

JM 

* 

FT-LB~S**2  MOTOR  AND  GEAR  MOMENT  OF  I 

ODM 

10000 

RPM 

MAX  MOTOR  SPEED 

N 

* 

DEG/DEG 

DIFF  OUTPUT-TO-SURFACE  GEAR  R 

KO 

* 

IN-LBS/RAD  STRUCTURAL  SPRING  RATE 

JP 

* 

IN-LB-S*)K2  LOAD  MOMENT  OF  INERTIA 

BP 

* 

IN-LB/ (R/S)  LOAD  DAMPING 

TC 

% 

IN-LB 

LOAD  FRICTION 

TS 

% 

IN-LB 

LOAD  STICTION 

KFB 

.625 

U/RAD 

POSITION  SENSOR  GAIN 

KR 

% 

V/(R/S) 

RATE  GAIN 

KA 

* 

AMP/V 

SERVO  POSITION  GAIN 

TAU 

% 

SEC 

POS  FBK  TIME  CONSTANT 

UBATT 

270 

VOLTS 

BATTERY  VOLTAGE 

L 

0.0 

HENRY 

MOTOR  INDUCTANCE 

RM 

. .2 

OHMS 

MOTOR  RESISTANCE 

KU 

0.0 

FT*/(R/S)*>K2  MOTOR  WINDAGE 

1/T 

100 

HZ 

SAMPLING  FREQUENCY 

RPSQ 

15 

DEG 

RPS  QUANTIZATION 

TM 

— 

FT-LB 

MOTOR  TORQUE  (TOTAL) 

0M1»0M2 

— 

RAD 

MOTOR  *1.*2  POSITIONS 

OD 

— 

RAD 

DIFF  OUTPUT  SHAFT  POSITION 

— 

OHMS 

POWER  SOURCE  RESISTANCE 

— 

HENRY 

POWER  SOURCE  INDUCTANCE 

TP  A 

— 

DEG-F 

ACTUATOR  CP  TEMP 

TPE 

— 

DEG-F 

ELECTRONICS  CP  TEMP 

OG 

— 

RAD 

POWER  HINGE  POSITION 

DELTA 

— 

RAD 

PANEL  POSITION 

DELTA-SEN  — 

RAD 

SENSED  PANEL  POSITION 

TP 

— 

IN-LB 

DEVELOPED  TORQUE  AT  HINGE 

TAERO 

— 

IN-LB 

AERO  LOAD  TORQUE 

% TO-BE-SUPPLIED 
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The  flaperon  control  and  redundancy  management  (RM)  architecture  have  been 
established  to  accept  realistic  skew  and  transport  delays  from  redundant  flight  control 
computers. 

G.4.1.3  DESIGN  CHARACTERISTICS 
G.4. 1.3.1  Servo-Loop  Features 

The  flaperon  position  servo  design  provides  the  following  functions  and  features: 

• Surface  position  control 

• Maximum  surface  response  characteristics 

• Stabilization  compensation  in  the  presence  of  structural  compliance 

• Stabilized  motor  control  in  the  presence  of  velocity-  and  torque-summing 
perturbations 

• Realistic  tolerances  and  variations  of  interfacing  and  parallel  elements 

Position  control  is  accomplished  by  comparing  flight  control  digital  data  bus  position 
command  to  encoded  surface-position  feedback  with  compensation  applied  to  the  position 
error  signal.  Redundancy-related  elements  alter  gain  as  a function  of  redundant  motor- 
channel  status. 

Servo-loop  response  time  is  optimized  by: 

• Closed-loop  motor-current  feedback  control 

• Maximum  motor  and  electronics  torque-to-inertia  ratio 

• Minimum  associated  gear  ratio 

Servo-loop  stability  is  maximized  by  motor-rate  feedback  and  blending  of  motor  shaft 
position  with  surface  position  for  compliance  compensation.  Motor  shaft  rate  is  derived 
from  the  rotor  position  sensor  (RPS)  used  for  commutation  logic. 
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G.^.  1.3.2  Thermal  Considerations 


Flaperon  actuation  elements  meet  the  in-flight  hinge  moment  rate  profiles,  including  stall 
for  an  indefinite  period,  with  no  active  auxiliary  cooling.  Thermal  mass  heat  sinking  will 
accommodate  the  power-loss  heat  rates  without  exceeding  reasonable  temperature  ratings 
of  EMA  materials.  Avoidance  of  active  cooling  while  avoiding  unnecessary  weight 
requires  the  use  of  carefully  structured  and  hardware-correlated  thermal  models  and 
flight  simulations. 

The  flaperon  indefinite-period  in-flight  stall  provides  the  primary  thermal  sizing 
requirements.  Two  other  special  conditions,  however,  required  a design  handshake  with 
redundancy  management  functions  to  avoid  component  thermal  degradation  or  failure 
propagation;  (1)  high  ground-soakback  temperature  plus  inadvertent  actuator  stall  during 
ground  operations  and  (2)  motor-shorted  turn(s)  fault.  Because  ground  soakback  may 
result  in  EMA  temperatures  of  70°  to  120°C  (160°  to  250°F),  any  significant  power 
dissipated  in  the  EMA  elements  could  raise  the  respective  temperatures  to  intolerable 
levels. 

A motor-winding  shorted  turn  causes  a dynamic  damping  effect  that  requires  overcoming 
a higher  power  level  of  summed  motors.  Power  dissipated  in-  the  shorted  turn(s)  and  the 
increased  compensating  power  result  in  an  increased  temperature  rate  versus  command 
profile.  Both  special  cases,  are  accommodated  by  adapting  a high-temperature-sensor 
circuit  to  interrupt  the  power  drive  when  the  motor  or  electronics  approaches  the  over- 
temperature state.  Provision  is  made  for  flight  control  override  on  a need-decision  basis. 

Note  that  although  the  EMA  elements  may  survive  an  application  of  high  temperature,  the 
ultimate  life  of  the  element  will  decrease.  Lengthy  testing  of  motor-winding  insulation 
indicated  that  ultimate  electric  breakdown  is  a function  of  accumulated  temperature  and 
time.  That  is,  the  insulation  life  may  be  used  by  several  high-temperature,  short  time 
cycles  or  an  infinite  number  of  low-temperature,  long  time  cycles.  Design  and  operation 
of  the  EMA  must  reflect  both  normal  and  abnormal  thermal  considerations  to  provide 
reliable  long-life  operation. 
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G.4. 1.3.3  Preflight  Checkout,  Built-In  Test 


Flaperon  SDEUs  contain  BIT  routines  in  an  erasable,  programmable  read-only  memory 
(ROM)  state  that  may  be  initiated  by  flight  control  and/or  crew  command  to  thoroughly 
test  the  actuator,  its  control  and  monitoring  functions,  and  system  elements  before  or 
after  a flight.  The  BIT  requires  no  rollup  support  hardware  and  is  intended  to  provide 
nearly  100%  confidence  in  the  flaperon  functional  status. 

G.^.  1.3.4  Electromagnetic  Interference 

Electromechanical  actuation  poses  two  concerns  for  development  consideration.  Use  of 
high  voltage  (270V  dc)  in  conjunction  with  high  currents,  modulated  by  variable  frequency 
or  pulse  width,  inherently  produces  broad-spectrum  conducted  and  radiated 
electromagnetic  interference  (EMI).  Use  of  digital-processor-based  electronics  in  close 
proximity  to  these  noisy  circuits  predicates  use  of  enclosures,  shielding,  filtering  and 
optical  isolation,  and/or  fiber  optics  to  avoid  interaction. 

Conducted  EMI  on  the  high-voltage  power  buses  will  require  several  techniques  to 
minimize  interaction  among  flaperon  coi>trollers  or  other  avionics.  Current  industry 
techniques  involve  (1)  flat  laminated  cables,  (2)  coaxial  cables,  and  (3)  ac/dc  converters 
with  filters  for  each  EMA.  Power-spectral-density  profiles,  as  a function  of  flaperon 
mission  timeline  profiles,  will  allow  selection  of  the  best  cable  and  source  EMI  technique 
for  this  application. 


G.4.2  ADVANCED  HYDRAULIC  CONCEPTS 

The  objective  of  the  advanced  hydraulic  concepts  task  was  to  define  the  hydraulic 
actuators  to  be  used  on  the  1990  ACT  system.  This  objective  was  arrived  at  following  the 
actuation  survey  studies  described  in  Subsection  G.2.3.  According  to  these  studies,  it  was 
decided  that; 

• Fly-by-wire  (FBW)  control  will  be  applied  in  all  three  axes. 

• Conventional  cylinder-type  hydraulic  actuators  will  be  used  in  all  hydraulic  control 
actuator  applications. 
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• Ail  ACT  control  surfaces  will  be  driven  by  hydraulic  actuators  except  for  the 
flaperons,  which  will  be  driven  by  EMAs. 

GA.2A  ACTUATION  CONCEPTS 

Two  classes  of  actuators  were  examined:  the  first  uses  magnetic  summing  of  torque 

motor  current;  the  second  uses  active,  online  principles.  These  two  classes  of  actuators 
were  judged  to  represent  concepts  that  will  be  probable  industry  leaders  in  the  1990s. 

The  magnetic  summing  of  torque  motor  currents  is  embodied  in  a class  of  actuators  that 
includes  position-summed  modulating  pistons,  as  shown  in  Figure  G-27,  or  a unique  form 
of  flow  summing,  as  shown  in  Figure  G-28.  In  both  cases,  all  control  loops  are  electrically 
closed.  The  alternative  of  closing  the  loop  mechanically  from  the  modulating  piston  to 
the  single-stage  valve  is  apparent  in  both  actuators. 

The  two  actuators  operate  similarly.  The  servo  loops  for  each  electric  channel  are  closed 
from  sensors  on  the  modulating  pistons  (or  main  control  valves)  and  the  output  cylinders. 
It  is  not  necessary  to  have  the  same  number  of  electric  channels  and  hydraulic  channels 
because  all  servo  torque  motor  signals  are  sent  to  all  electrohydraulic  valves  (EHV)  where 
they  are  magnetically  summed. 

Each  hydraulic  channel  has  two  EHVs.  The  actuator  in  Figure  G-27  has  each  of  the  two 
EHVs  driving  modulating  pistons  with  an  output  that  drives  the  main  control  valve  through 
a summing  lever  arrangement.  In  Figure  G-28,  the  two  EHVs  are  connected  in  series,  and 
the  output  (a  low-pressure  gain  signal)  positions  the  main  control  valve. 

Output  from  the  main  control  valve  positions  the  output  cylinder.  Output  cylinder 
feedback  transducers  are  provided,  and  their  signals  are  used  to  close  the  position  loop  of 
the  actuator. 

The  electronic  channels  are  monitored  by  comparison  of  the  torque  motor  currents 
between  electric  channels.  The  hydraulic  channels  are  monitored  by  noting  outputs  from 
the  position-difference  sensors,  as  is  shown  in  Figure  G-27,  and  from  the  pressure  sensor 
shown  in  Figure  G-28.  The  pressure  sensor  detects  failures  in  either  EHV  by  ensuring  that 
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• Electronic  channels  magnetic  summed 

• Hydraulic  channels  force  summed  (low- 
pressure-gain  equalized) 

• Dual  load-path  hydraulic  pressure 
monitoring 

• All  loop  closures  electronic 


Figure  G-28.  Flow  Summing 


Figure  G-29  shows  an  active,  online  actuator.  A single  hydraulic  channel  is  shown.  The 
single  channel  shown  may  be  one  of  several  similar  units  force  summed  on  the  control 
surface  or  may  be  one  of  a number  of  tandem  units.  Each  channel  has  transducers  for 
cylinder  position  and  force  feedback  (pressure  sensor)  and  for  velocity  feedback  (EHV 
second-stage  spool  position). 


Error  signals  are  supplied  to  a conventional  two-stage  EHV  with  a flow  that  positions  the 
output  cylinder  and  closes  the  position  loop. 

As  shown  in  Figure  G-30,  the  active  channel  used  the  pressure  sensor  feedback  signal  only 
for  commanding  the  force  output  of  the  online  channels.  Online  channels  use  the  pressure 
feedback  signal  to  compare  with  that  of  the  active  channel  and  compensate  for  any  static 
load  differences. 
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Cylinder 


• Active,  online,  force  summed  (one 
channel  shown) 

• Electronic  position,  velocity  and 
force  feedback 

• Electronic  model  monitoring  and 
engage-bypass  operation 


Figure  G-29.  Active,  Online  Actuator 


Actuator 

position 

command 


Figure  G-30.  Active,  Online  Actuator  Channel  Block  Diagram 
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Each  channel  of  actuation  is  monitored  electrically  by  a modeling  technique.  The  position 
of  the  second-stage  spool  of  the  EHV  is  easily  modeled  as  a function  of  the  actuator 
position,  position  command,  and  pressure  feedback  signals. 

Ideally,  the  several  actuation  channels  could  operate  in  concert  with  one  another  in  an 
each-channel-active  configuration.  However,  because  of  the  high-pressure  gain 
characteristic  of  actuator  valves,  small  tolerances  in  the  actuator  control  loops  would 
lead  to  significant  force  opposition  between  channels.  The  pressure  feedback  path  in  the 
online  channels  must  overcome  this  force-fight  tendency  by  offsetting  the  tolerances 
between  channels. 

A limiter  is  provided  in  the  pressure  feedback  path,  as  shown  in  Figure  G-30.  This  limiter 
is  set  at  a value  so  that  the  pressure  feedback  signal  can  slightly  exceed  the  maximum 
tolerance  between  channels.  Previous  tolerance  studies  of  a similar  servoactuator  control 
loop  indicated  a maximum  tolerance  between  any  two  channels  in  terms  of  torque  motor 
currents  to  be  2.8  mA.  In  these  studies,  full  displacement  command  to  a centered 
actuator  corresponded  to  800  mA  of  torque  motor  current.  An  8-mA  EHV  was  used,  and  a 
pressure  feedback  limit  of  +4  mA  was  chosen. 

Thus,  the  pressure  feedback  is  effective  in  allowing  the  actuators  to  share  the  output 
load.  However,  the  online  actuator  (or  actuators)  will  oppose  any  active  channel 
malfunction  as  soon  as  a displacement  corresponding  to  k mA  {^IZOO  of  full  travel)  is 
exceeded. 

Upon  detection  of  any  failure  in  the  active  channel  by  the  monitor  computer,  one  of  the 
online  channels  will  be  switched  to  the  active  status  by  removing  the  pressure  feedback. 

The  active,  online  actuator  concept  was  successfully  test  flown  by  Boeing-Vertol  on  the 
347  helicopter  as  a part  of  the  Heavy  Lift  Helicopter  Advanced  Technology  Components 
Program. 
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G.4.2.2  ACTUATOR  COMPARISONS 

The  two  candidate  actuator  concepts  were  used  to  determine  the  type  of  surface 
actuation  system  that  would  be  the  least  expensive.  Three  elevator  actuation  systems 
were  hypothesized  for  the  subject  aircraft  (fig.  G-31). 

A three-channel  (hydraulic)  secondary  actuator  was  used  to  drive  six  conventional 
hydromechanical  surface  actuators.  The  secondary  actuator  used  magnetic  summing  of 
four  control  channels  and  operated  like  a small  F-18  stabilizer  actuator. 

Three  (hydraulic)  channels  of  an  F-18  type  manifold  (similar  to  those  used  on  the  leading- 
edge  flaps)  were  used  to  drive  six  surface-mounted  cylinders.  Four-channel  magnetic 
summing  was  used. 

Six  identical  active,  online  actuators  (three  per  surface)  were  used  to  drive  the  surfaces 
direct.  The  remote  terminal  would  be  used  to  provide  the  proper  signal  selection. 

This  study  showed  that  the  active,  online  concept  was  by  far  the  lowest  cost  arrangement 
(approximately  half  the  cost  of  the  other  concepts)  and  that  reliability,  determined  on  the 
basis  of  parts  count,  was  significantly  better.  These  results  are  shown  in  Table  G-14. 

Performance  was  judged  to  be  adequate  for  any  of  the  three  alternatives. 

The  integrated  active,  online  actuator  was  therefore  selected  for  the  1990  ACT  system. 

G.4.2.3  ACTUATOR  COMPLEMENT  FOR  ACT  AIRCRAFT 

ACT  has  14  control  surfaces  (7  pairs). of  which  10  are  hydraulically  actuated  and  4 are 
electromechanically  actuated.  All  the  hydraulic  actuation  systems  use  simple,  single- 
cylinder active,  online  actuators  except  those  for  the  outboard  aileron,  inboard  segment- 
for  this  installation,  a dual-tandem  design  is  used.  Control  paths  and  hydraulic  power 
distribution  patterns  are  shown  in  Figure  G-29. 
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I Secondary  Actuator  Hydromechanical 
Surface  Actuator 


III  Integrated  Active  Online 


II  Integrated  With  Remote  Cylinders 


Mechanical 

Hydraulic 

Electronic 


Figure  G-31.  lAAC  Eleva tor  Actuation  Concep ts 
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Table  G-14.  Servo-Concept  Comparisons 


Servo-concept 

Relative  cost 

Failure  rate  (per  hour) 

1 Secondary  actuator 

1.0 

800 X 10"® 

II  Integrated  actuator 

ft 

with  remote  cylinders 

1.25 

840  X 10  ” 

III  Integrated  active, 

online  actuators 

0.62 



670x  10  ® 

The  actuator  characteristics  are  shown  in  Table  G-15— the  geometry  of  the  hydraulic 
actuators  is  representative  only;  bore-stroke  and  surface-horn  dimensions  may  be  adjusted 
for  the  individual  installation. 

The  requirements  show  that  most  of  the  actuators  are  relatively  low  powered  and  that 
design  details  such  as  cylinder  wall  thickness  (all  designed  with  steel  barrels)  and  piston 
rods  are  sized  for  handling  and  side  loads,  as  opposed  to  being  optimized  for  tension  or 
compression  loading. 

Bypass  valves  are  of  minimum  size  because  the  actuator  provides  flutter  damping  in  the 
"off"  condition. 

Two  actuators  were  sized  for  high-pressure  hydraulic  systems:  the  outboard  aileron, 

outboard  segment,  and  the  rudder.  Note  that  the  effect  on  the  weight  of  the  larger  unit  is 
much  more  pronounced. 

Figure  G-32  shows  how  the  signal  paths  are  distributed  to  the  control  surface  actuators 
and  their  terminals.  While  EMAs  for  the  trailing-edge  flaperons  have  servodrive 
electronics  units  (SDEU),  remote  from  the  actuator,  integral  remote  terminals  are  a part 
of  the  hydraulic  actuators. 

The  integral  actuator  terminal  and  its  interconnects  are  shown  in  Figure  G-33.  Note  that 
the  command  signals  (position  pressure  and  mode  select)  drive  the  actuator,  while  the 
sensor  validity  signals  are  used  for  monitoring  by  the  ACT  computer.  Structural 
compensation  also  can  be  included  in  the  remote  terminal. 
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Table  G-15.  lAAC  Hydraulic  Actuator  Characteristics 


Control 

surface 

Outboard 

aileron 

outboard 

segment 

Outboard 

aileron 

inboard 

segment 

Inboard 

aileron 

Elevator 

Rudder 

Hinge  moment, 
N-m  (in-lb) 

1017 

(9000) 

553.6 

(4900) 

4 745 
(42  000) 

7 344 
(65  000) 

20  902 
(185  000) 

Deflection,  deg 

+1 5,  -30 

±15 

±20 

+20,  -30 

±25 

Average  rate, 
deg/s 

54 

100 

30 

40 

40 

Cylinder  diameter, 
cm  (in) 

3.81 

(1.500) 

2.54 

(1.000) 

8.573 

(3.375) 

7.381 

(2.906) 

10.475 

(4.125) 

Rod  diameter, 
cm  (in) 

1.587 

(0.625) 

1.587 

(0.625) 

1.587 

(0.625) 

1.905 

(0.750) 

2.857 

(1.125) 

Stroke,  cm  (in) 

3.957 

(1.558) 

2.522 

(0.993) 

5.898 

(2.322) 

7.473 

(2.942) 

10.693 

(4.210) 

Horn  radius,  in 

2.053 

1.920 

3.395 

3.499 

4.985 

Net  piston  area, 
cm^  (in^) 

9.4245 

(1.4608) 

3.0877 

(0.4786) 

28.406 

(4.403) 

39.9406 

(6.1908) 

79.806 

(12.370) 

Maximum  flow, 
cm^/s  (in^/s) 

60.025 

(3.663) 

34.167 

(2.085) 

180.67 

(11.025) 

340.75 

(20.794) 

950.48 

(58.002) 

Average  flow, 
cm^/s  (in^/s) 

45.04 

(2.748) 

25.61 

(1.563) 

135.5 

(8.267) 

255.6 

(15.59) 

712.8 

(43.49) 

Orifice  diameter 
for  6 894  700  Pa 
(1000  Ib/in2),cm  (in) 

0.05 

(0.020) 

0.038 

(0.015) 

0.089 

(0.035) 

0.122 

(0.048) 

0.206 

(0.081) 

Actuator  weight 
for  20  684  100  Pa 
(3000lb/in2»,kg  (lb) 

2.78 

(6.14) 

5.08 

(11.21 

3.43 

(7.56) 

4.73 

(10.43) 

■ 

8.0 

(17.64) 

Actuator  weight 
for  55  157  600  Pa 
(8000  Ib/in2),kg  (lb) 

7.085 

(15.62) 
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Figure  G-32.  Surface  Actuator  Control  System 
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Figure  G-33.  Remote  Terminal  Hydraulic  Servo 


The  hydraulic  actuation  system  uses  22  electrohydrauiic  servovalves  (6  in  supply  system 
A,  8 in  B,  and  8 in  C),  one  for  each  actuation  cylinder.  Each  is  a line  replaceable  unit 
(LRU)  and  may  be  replaced  without  removing  the  actuator  from  the  aircraft.  Integral 
connectors  and  lack  of  mechanical  interfaces  (e.g.,  feedback  wires)  are  contributing 
design  details. 

The  differential  pressure  sensor,  with  its  integral  transducer,  is  also  an  LRU.  Some 
consideration  should  be  given  to  the  use  of  two-gage  pressure  sensors,  one  in  each  cylinder 
line.  This  would  allow  continuous  monitoring  of  EHV  erosion  and  provide  the  load  pressure 
sensing.  The  former  would  be  a distinct  advantage  over  present  servovalve  maintenance 
methods. 
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Solenoid-operated  engage  bypass  valves  would  also  be  of  LRU  design.  Valve  area  is  sized 
to  provide  flutter  damping  in  the  "off"  position.  The  size  of  the  solenoid  required  is 
minimized. 
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G.5.0  1990  SYSTEM  IMPLEMENTATION  FOR  lAAC 


The  1990  ACT  system  is  described  in  this  section.  Selection  of  the  1990  ACT  system  was 
based  on  the  three  system  definitions  (low,  medium,  and  high  risk)  described  in  Section 
G.3.0.  It  most  closely  resembles  the  medium-risk  system  described  in  Subsection  G.3.2. 

Features  of  the  1990  ACT  system  are: 

• Extensive  busing  techniques  are  used  for  sensor-computer  and  computer-actuator 
interfaces: 

• Aircraft  wiring  is  reduced  in  weight  and  cost. 

• All  sensor  data  are  available  to  all  channels  of  computing. 

• Sensors  and  actuators  have  self-contained  electric  power  supplies  and  bus  interface 
circuitry. 

• Software  costs  are  reduced,  and  software  validation  and  verification  is  simplified: 

• Separate  microcomputers  perform  input/output  (I/O),  control  law  computa- 
tions, and  redundancy  management. 

• Computing  channels  are  asynchronous. 

• Crucial  function  reliability  is  enhanced  by  a microcomputer  reconfiguration 
strategy: 

• I/O  computer  does  crucial  control  law  computation  if  control  law  computing 
fails. 


Subsections  G.5.1  and  G.5.2  describe  the  1990  ACT  system.  Subsection  G.5.3  presents  the 
reliability  projections  for  the  system.  Subsection  G.5.4  presents  the  cost-of-ownership 
parameters. 
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G.5.1  SYSTEM  CONFIGURATION 


G.5.1.1  SYSTEM  ARCHITECTURE 

The  1990  ACT  system  is  an  integrated  one;  i.e.,  all  functions  are  performed  by  each  of  a 
set  of  four  ACT  computers.  Sensors  and  control  surface  actuators  are  shared  between 
functions  to  the  extent  allowed  by  the  control  laws. 

The  1990  ACT  system  is  fly  by  wire  (FBW).  All  control  surface  actuators  are  driven  only 
by  the  electric  signals;  there  is  no  mechanical  control  system. 

The  system  architecture  is  shown  in  Figure  G-34.  A set  of  four  buses  interfaces  the 
sensors  with  the  computers.  Similarly,  a set  of  four  buses  interfaces  the  computers  with 
the  surface  actuators.  The  ACT  Maintenance  and  Display  Computer,  warning  electronics 
module,  and  dedicated  ACT  panel  also  interface  with  the  four  ACT  computers  by  means 
of  the  same  set  of  four  buses  associated  with  the  power  actuators. 

The  digital  air  data  computer  (DADC)  and  inertial  reference  system  (1R5)  are  airplane 
sensors  that  interface  with  the  ACT  computers  via  buses.  For  the  aircraft,  they  are 
defined  as  intersystem  buses.  The  IRS  is  capable  of  interfacing  with  the  ACT  system  via 
the  quadruple  intrasystem  buses  as  well  as  the  intersystem  buses.  This  is  necessary 
because  the  pitch-rate  and  acceleration  signals,  used  for  crucial  functions,  need  to  be 
obtained  more  reliably  and  faster  than  is  possible  with  an  intersystem  bus  presumed  to  be 
of  the  Aeronautical  Radio  Incorporated  (ARINC)  ^■2^  type. 

Figure  G-35  shows  the  aircraft  interconnect  wiring.  In  addition  to  the  sensor  and  actuator 
buses.  Figure  G-35  shows  the  airplane  electric  power  distribution  to  each  of  the  ACT 
flight  control  system  line  replaceable  units  (LRU).  Only  +28V  dc  power  is  used  to  power 
the  system  except  for  the  flaperon  electromechanical  actuators  (EM A).  Four  +28 V dc 
power  buses  are  provided.  These  are  designated: 

• Transformer-rectifier  (T-R)  bus  1 (T-Rl) 

• T-R  bus  2 (T-R2) 

• Battery  bus  1 (Bl) 

• Battery  bus  2 (B2) 
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Figure  G-34.  1990  ACT  System  Architecture 
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Figure  G-35.  lAAC  19.90  ACT  Aircraft  Interconnect  Wiring  Diagram 
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As  shovv-n  in  Figure  G-35,  each  LRU  is  provided  with  two  sources  of  +28V  dc  power.  One 
source  of  power  is  a T-R  bus;  the  other  is  a battery  bus.  These  two  sources  of  power  are 
diode  "ORed"  within  each  LRU.  With  this  arrangement,  and  with  the  basic  reliability  of 
the  airplane  dc  buses,  the  loss  of  power  to  any  flight  control  system  LRU  is  virtually 
impossible. 

Each  sensor  contains  bus  interface  electronics,  which  include  an  analog-to-digital  (A/D) 
converter,  an  asynchronous  serial  I/O  communications  circuit,  and  logic  required  to 
recognize  a data  request  and  format  the  data  response  for  transmission  to  the  computers 
on  the  sensor  bus.  Each  response  will  include  data,  label,  and  a parity  bit. 

Each  sensor  bus  is  controlled  from  one  of  the  ACT  computers.  Each  computer  receives 
the  data  from  all  four  sensor  buses  and  stores  it  in  memory  locations  corresponding  to  the 
label. 

The  actuator  buses  provide  a communications  path  from  the  ACT  computers  to  the 
actuators.  Four  actuator  buses  are  provided  that  are  normally  assigned  to  each  of  the 
four  ACT  computers.  The  servoactuators  are  controlled  from  the  computers.  The 
specific  assignment  of  each  hydraulic  actuator  to  a bus  is  indicated  in  Figure  G-35.  This 
assignment  is  consistent  with  the  Baseline  Configuration  assignment  of  hydraulic  systems 
to  surface  actuators.  An  address,  a position  command  signal,  a servo  state  signal,  and  a 
parity  bit  are  transmitted  to  each  actuator. 

Each  hydraulic  servoactuator  contains  electronics  to  receive  and  decode  the  serial  data, 
convert  the  command  to  an  analog  signal,  demodulate  the  feedback  signals  required  for 
servo  control,  and  close  the  servo  loop.  The  servoelectronics  also  transmit  signals  on  the 
bus  in  response  to  ACT  computer  requests,  which  include  the  feedback  signals  required  for 
monitoring  of  the  servo. 

The  EMAs  associated  with  the  flaperons  similarly  interface  with  the  ACT  computers. 
However,  each  EMA  has  two  servodrive  electronics  units  (5DEU)  because  the  control 
electronics  required  for  the  EMAs  are  considerably  more  elaborate  than  those  required  for 
the  hydraulic  servos.  Much  of  the  EMA  monitoring  and  redundancy  management  is  done  in 
the  SDEUs. 
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The  ACT  Maintenance  and  Display  Computer  interfaces  with  the  servo  buses.  It  receives 
data  from  the  ACT  computers  indicating  the  failure  state  of  the  active  controls  system 
and  provides  fault  annunciation  messages  and  signals  to  the  caution  and  warning  system. 

The  ACT  discrete  display  also  interfaces  with  the  actuator  buses  and  provides  an 
independent  source  of  system  failure  status  information  to  the  crew. 

The  caution  and  warning  system  discrete  displays  also  interface  with  the  actuator  buses. 

G.5.1.2  ACT  SYSTEM  FUNCTIONAL  CONFIGURATION 

The  1990  ACT  system  has  the  same  functional  capabilities  as  the  Baseline  Configuration 
ACT  system.  In  addition,  FEW  control  Is  incorporated  in  all  three  control  axes.  Improved 
reliability,,  maintainability,  control  quality,  and  cost  result  from  the  change  from  a 
conventional  control  system  with  control  augmentation  to  FBW  control,  including  the 
same  augmentation  functions. 

The  1990  ACT  control  functions  are: 

• FBW,  crucial  pitch-augmented  stability  (PAS) 

• Critical  PAS 

• Lateral/directional-augmented  stability  (LAS) 

• Angle-of-attack  limiter  (AAL) 

• Wing-load  alleviation  (WLA) 

• Flutter-mode  control  (FMC) 

Figure  G-36  shows  the  FBW,  crucial  PAS  functional  block  diagram  for  the  pitch  axis.  The 
elevator  is  commanded  according  to  the  pilot's  control  column  position  and  the  aircraft 
pitch  rate.  Both  the  pilot  control  position  and  pitch-rate  signals  are  gain  scheduled  with 
dynamic  pressure  (q)  as  measured  by  the  DADC.  The  gain  is  reduced  at  high  dynamic 
pressures  so  that  a lesser  elevator  deflection  is  commanded  for  a given  applied  stick 
force.  As  a result  of  this  gain  schedule,  a simple  constant  spring-gradient  feel  system 
may  be  used. 
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Figure  G-36.  Fly-by-Wire,  Crucial  Pitch-Augmented  Stability 
Elevator  Control  Functional  Block  Diagram 


However,  neither  the  gain  schedule  of  the  control  column  command  nor  the  gain  schedule 
of  pitch  rate  is  essential  to  the  realization  of  a control  system  that  allows  safe  flight. 
Loss  of  the  dynamic  pressure  signal  due  to  a combination  of  DADC  failures  is  not 
catastrophic. 

The  pilot  stabilizer  trim  command  is  channeled  directly  to  the  stabilizer  actuator 
controls,  as  in  the  Baseline  Configuration  control  system.  Automatic  trim,  as  required  for 
autopilot  control,  is  supplied  directly  from  the  autopilot-flight  director  system. 

FBW  control  in  the  roll  and  yaw  axes  consists  of  pilot  control  column  and  rudder  pedal 
commands  to  the  roll  and  yaw  control  surface  actuators,  respectively.  Trim  in  these  axes 
is  provided  by  an  integration  of  the  trim  signal  commands  within  the  ACT  computers. 

The  1990  ACT  control  functions— other  than  the  FBW,  crucial  PAS— are  functionally  the 
same  as  in  the  Baseline  Configuration  ACT  system. 
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Table  G-16  shows  the  ACT  sensors  and  the  way  they  relate  to  the  ACT  functions.  For 
example,  the  air  data  parameters  required  for  gain  scheduling  are  required  for  ail 
functions  except  FBW.  The  angle-of-attack  signal  is  required  for  the  AAL  function  only. 

Pitch-rate  and  normal  acceleration  signals  are  obtained  from  the  IRS.  -The  IRS  is  triplex, 
and  dispatch  should  be  possible  with  one  IRS  failed.  FBW,  crucial  PAS  reliability  will  be 
adequate  if  pitch  rate  is  estimated  from  normal  acceleration.  This  technique  also  allows 
airplane  dispatch  with  one  IRS  failed.  The  manner  in  which  the  pitch-rate  estimation  is 
achieved  is  described  in  Section  G.6.0. 

Table  G-17  shows  the  ACT  system  matrix  relating  control  surface  actuators  to  control 
functions.  Note  that  safe  flight  can  be  achieved  with  either  the  upper  or  lower  rudder 
actuation  system  failed  and  deployed  in  a damped  trail  position.  Similarly,  safe  roll 
control  is  possible  with  either  the  inboard  aileron  or  both  outboard  aileron  surfaces 
properly  controlled.  Both  right  and  left  elevator  surfaces  must  be  controlled  properly  for 
safe  flight. 


Table  G-16.  ACT  Sensor  Control  Function  Matrix 


Sensors 

required 

Control 
mode  function 

Digital  air 
data  computer 

Normal 

acceleration 

WLA 

Normal 

acceleration 

FMC 

Inertial  reference  system 

■ 

Control  position  transducer 

q,V,M 

a 

Left 

I3H!H 

Left 

mam 

0 

r 

fSWIl 

f3BH 

Fly  by  wire,  crucial 
PAS 

■ 

■ 

■ 

■ 

« 

X 

* 

X 

■ 

■ 

D 

X 

X 

B 

Critical  PAS 

D 

X 

B 

Lateral/directional- 
augmented  stability 

D 

■ 

■ 

■ 

■ 

■ 

X 

H 

B 

X 

B 

Wing-load  alleviation 

X 

B 

a 

X 

■ 

■ 

D 

■ 

■ 

B 

B 

Flutter-mode  control 

B 

■ 

■ 

D 

O 

■ 

■ 

■ 

B 

B 

Angle-of-attack  limiter 

X 

B 

X 

D 

B 

* Either  pitch  rate  or 
normal  acceleration  signal 
required  for  safe  flight. 
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Table  G-17.  ACT  Actuator  Control  Function  Matrix 


Control  surface 

Number  of 
actuators 

Function 

FBW 

Critical  PAS 

AAL 

LAS 

WLA 

FMC 

Elevator 

6 

X 

X 

X 

Upper  rudder 

2 

B 

X 

Lower  rudder 

2 

X ^ 

X 

Outboard  aileron 
outboard 

4 

X 

X 

Outboard  aileron 
inboard 

4 

X b 

X 

X 

Inboard  aileron 

4 

B 

Outboard  flaperon 

4 

X 

Inboard  flaperon 

4 

X 

^Either  upper  or  lower  rudder  required  for  safe  flight. 

^Either  inboard  aileron  or  both  outboard  aileron  surfaces  are  required  for  safe  flight  (both  left  and  right  wings). 


G.5.1.3  1990  ACT  SYSTEM  COMPONENTS 

The  1990  ACT  system  components  are  characterized  by  the  use  of  advanced  large-scale 
integrated  circuit  (LSIC)  technology.  As  noted  in  Subsection  G.2.2,  developments  in  very- 
large-scale  integrated  circuit  (VLSIC)  and  very-high-speed  integrated  circuit  (VHSIC) 
technologies  are  expected  to  allow  a full  order-of-magnitude  improvement  in  performance 
for  a computing  function.  Power  and  weight  will  be  reduced,  and  the  very-large-scale 
integration  will  significantly  reduce  the  chip  count. 

The  integrated  circuit  developments  listed  below  are  planned  if  they  are  not  available  as 
standard  circuits.  The  quantity  utilization  estimated  for  the  ACT  system  alone  would 
justify  their  developments  as  custom  LSIC; 
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• Switching  regulator 

• Serial  terminal  interface 

• Bus  transceiver 

• Demodulator  and  A/D  converter 

• ■ A/D,  digital-to-analog  (D/A)  converter  and  multiplexer 

• Analog  servoelectronics 

• Microcomputer 

• Servoamps 

The  switching  regulator  input  controller  (IC)  would  be  used  as  part  of  a power  supply 
module,  as  illustrated  in  Figure  G-37.  The  switching  regulator  provides  the  drive  to  a 
switching  pass  transistor  to  regulate  the  output  voltage  as  required.  The  switching  occurs 
at  approximately  120  kHz.  Additional  discrete  parts  are  added  to  produce  a power  supply 
module  with  a negative  voltage.  Similarly,  a 2-kHz  power  supply  module  is  produced  by 
adding  a discrete-part  oscillator  driven  by  a regulated  dc  input  voltage.  Short-circuit 
protection  is  provided  within  the  switching  regulator  IC. 

The  function  of  the  other  LSICs  will  be  described  in  conjunction  with  the  LRUs  in  which 
they  are  used. 


Pass 


Regulated 

output 

voltage 


Figure  G-37.  Power  Conditioning  Module 
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Control  position  transducers  sense  motions  of  the  pilot  control  columns  and  rudder  pedals 
and  provide  voltages  proportional  to  slat  and  flap  deflection.  These  transducers  are  either 
triple  or  quadruple  redundant  depending  on  the  criticality  of  the  function. 

The  quadruple  control  position  transducers  contain  four  sets  of  sensor  electronics,  one  for 
each  linear  variable  differential  transformer  (LVDT)  type  of  transducer.  Four  connectors 
on  pigtails  are  supplied  to  mate  with  aircraft  connectors.  In  this  way,  the  four  channels 
of  the  transducer  are  electrically  isolated  and,  to  a large  extent,  mechanically  isolated 
from  one  another. 

One-channel  sensor  electronics  is  shown  in  Figure  G-38.  Four  power  conditioning  modules 
are  supplied  so  that  the  required  local  power  supply  voltages  are  realized.  Excitation  is 
provided  to  the  LVDT.  The  LVDT  center  tapped  output  is  demodulated  so  that  two  signals 
are  provided.  The  difference  of  these  two  signals  is  proportional  to  the  mechanical  input 
to  the  position  transducer.  The  sum  is  a signal  that  remains  approximately  constant  for  a 
properly  functioning  transducer.  These  two  signals  are  converted  to  digital  words  by  the 
A/D  converter  and  transmitted  on  the  serial  data  bus  by  the  serial  terminal  interface  and 
bus  transceiver  in  response  to  bus  controller  requests.  The  triplex  control  position 
transducers  used  to  sense  flap  and  slat  position  operate  this  way.  The  only  difference  is  in 
the  number  of  sensor  electronics  sets  and  LVDTs. 


Figure  G-38.  Sensor  Electronics 
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Each  hydraulic  servoactuator,  described  in  Subsection  G.4.2,  includes  a hydraulic  servo 
remote  terminal,  as  shown  in  Figure  G-39.  Four  power  conditioning  modules  are  required, 
and  26V  ac  is  provided  to  the  three  LVDTs  required  in  the  actuator.  Servo-loop  closure  is 
effected  by  the  analog  IC  as  shown.  The  A/D,  D/A,  and  multiplexer  circuit  decodes  the 
servo  position  command  and  servo  state  signals,  which  are  passed  to  the  analog  IC.  The 
circuit  also  converts  the  three  LVDTs  outputs  to  digital  words  for  transmittal  to  the  ACT 
computers  for  monitoring  of  the  servoactuator. 

SDEU  interfaces  the  ACT  computers  with  the  EMAs  used  to  drive  the  flaperons.  The 
SDEU  function  is  shown  in  Figure  G-40.  Use  of  a 16-bit,  fixed-point  microcomputer 
integrated  circuit,  including  IK  words  of  read-only  memory  (ROM)  and  512  words  of 
random-access  memory  (RAM),  is  unique  in  SDEU  implementation.  The  microcomputer  is 
used  for  actuator  monitoring  and  also  for  commutating  the  power  to  the  field  of  the  dc 
permanent  magnet.  The  field  is  commutated  in  accordance  with  the  position  error  signal, 
the  rotor  position  signal,  and  a motor  rate  signal  derived  from  the  rotor  position  sensor. 
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Figure  G-39.  Hydraulic  Servo  Remote  Terminal 
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Figure  G-40.  Servodrive  Electronics  Unit 


In  addition  to  the  LSIC  shown  in  Figure  G-40,  the  SDEU  contains  power  supply  circuitry 
associated  with  the  270V  dc  power  and  the  high-power  circuits  necessary  to  switch  this 
power  to  the  motor. 

The  ACT  computer  is  shown  in  Figure  G-41.  Major  functional  sections  include  I/O, 
control  law  computing,  and  redundancy  management.  A common  power  supply  and  clock 
are  provided  for  all  three  sections  of  the  ACT  computer. 

The  I/O  section  includes  the  input  and  actuator  bus  interface  .circuitry.  Input  data  are 
received  in  serial  digital  data  form  and  converted  to  parallel  data.  When  data  have  been 
received,  the  DMA  controller  stores  it  in  memory  according  to  its  label  and  predefined 
memory  location.  Data  output  is  accomplished  similarly.  The  DMA  controller  initiates  a 
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Figure  G-41.  ACT  Computer  Block  Diagram 
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fetch  from  the  memory  location  where  the  desired  output  has  been  stored.  The  output  is 
passed  to  the  actuator  bus  or  sensor  bus  serial  terminal  and  bus  transceiver  ICs  to 
complete  the  output  operation. 

Data  inputs  are  of  two  forms:  most  inputs  are  from  sensors  or  actuators  associated  with 
the  intrasystem  buses  of  the  ACT  control  system.  IRS,  autopilot,  and  air  data  computer 
signals  are  input  through  intersystem  buses.  ARINC  429  buses,  as  used  today,  are  assumed 
for  the  1990  ACT  intersystem  buses. 

The  I/O  central  processing  unit  (CPU)  periodically  performs  comparison  monitoring  of  the 
input  sensor  data  and  sets  failure  flags  as  appropriate.  The  midvalue  of  the  sensor  data  is 
defined  for  each  case  and  stored  in  the  shared  memory. 

The  shared  memory  interfaces  the  I/O  processor  and  the  control  law  processor.  It  is 
available  to  one  of  these  processors  during  the  in-phase  half-cycle  of  the  computer  clock 
and  available  to  the  other  during  the  out-of-phase  half-cycle.  Memory  access  time  is  less 
than  one-half  clock  period,  so  the  shared  nature  of  the  memory  is  transparent  to  both 
processors.  A relatively  small  amount  of  memory  is  required  here  as  it  is  used  only  for 
scratchpad  to  accommodate  parameters  that  must  be  passed  between  the  two  processors. 

The  control  law  computer  implements  the  control  laws  using  the  midvalue  sensor  data 
that  have  been  stored  in  the  shared  memory  by  the  I/O  processor.  The  servocommands 
that  result  from  the  control  law  computations  are  also  stored  in  the  shared  memory  so  the 
I/O  processor  has  access  to  the  command.  The  I/O  processor  periodically  outputs  the 
servoactuator  command  and  the  sensor  failure  flag  status  on  the  actuator  bus. 

The  redundancy  management  computer  receives  the  actuator  commands  from  each  of  the 
four  ACT  computers  via  the  actuator  buses.  It  monitors  the  four  commands  and  ensures 
that  all  are  correct.  The  servoactuators  are  also  monitored  by  the  redundancy 
management  computer.  Signals  necessary  for  actuator  monitoring  are  received  via  the 
actuator  buses.  The  failure  status  of  each  actuator  Is  defined.  The  sensor  failure  flag 
output  by  each  I/O  processor  is  also  received  and  analyzed  as  a part  of  the  overall  ACT 
system  failure  state  assessment. 
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The  redundancy  management  computer  outputs  discrete  commands  to  each  servo  via  the 
servo  buses.  These  discretes  command  each  actuator  to  be  active,  online,  or  bypassed  in 
accordance  with  the  system  failure  state.  It  also  outputs  a system  failure  status  word  or 
words  for  use  by  the  ACT  Maintenance  and  Display  Computer,  the  ACT  discrete  display, 
and  the  caution  and  warning  system  discrete  display. 

G.5.2  FAILURE  MANAGEMENT 

Figure  G-42  illustrates  the  redundancy  management  used  in  the  1990  ACT  system. 
Quadruple  (or  triple)  sensors  are  interfaced  with  quadruple  ACT  computers  by  a set  of 
sensor  data  buses  so  that  each  ACT  computer  has  access  to  all  the  redundant  sensor  data. 
The  sensors  are  monitored,  and  the  actuator  commands  are  computed  in  the  ACT 
computers  operating  asynchronously  with  one  another.  The  actuator  commands  are  output 
on  quadruple  actuator  buses  to  hydraulic  actuators  and  EMAs  assigned  to  specific  control 
surfaces.  Monitor  processors  contained  within  the  ACT  computers  monitor  the  actuator 
commands  and  the  actuator  performance  and  effect  fault  correction,  as  appropriate. 

The  sensor  bus  structures  multiplex  sensor  data  to  the  four  ACT  computers.  There  are 
approximately  20  data  inputs  to  these  buses.  The  transfer  rate  will  approximate  500 
samples  per  second  per  sensor. 

Each  bus  is  similar  to  a MlL-STD-1553  bus  and  is  controlled  by  a bus  controller  located  in 
one  of  the  ACT  computers.  The  bus  controller  is  dependent  only  on  the  computer  power 
supply  and  clock  for  its  proper  operation.  Highest  reliability  for  each  bus  and  bus 
controller  is  of  paramount  importance. 

The  fault  of  a dead  controller  or  a dead  terminal  (located  with  each  sensor)  will  be 
detected  by  sensor  comparison  monitoring  within  the  ACT  computer  and,  secondarily,  by 
watchdog-timer-type  checks  associated  with  the  bus  controller. 

Parity  bit  errors  will  reject  specific  data  transmissions. 

Certain  sensor  data,  typified  by  air  data  signals,  are  transmitted  to  the  ACT  computers  by 
ARINC  ^29  type  buses.  Each  of  the  A,  B,  and  C ACT  computers  receives  data  from  one 
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Figure  G-42.  1990  ACT  System  Simplified  Redundancy  Management  Block  Diagram 


of  the  three  DADCs  in  this  manner  at  a relatively  low  sample  rate.  These  data  output  on 
the  sensor  buses  by  the  ACT  computers  at  a rate  of  500  samples  per  second  so  that  each 
computer  has  access  to  all  three  sets  of  air  data. 

The  midvalue  of  the  redundant  sensor  data  is  determined  in  each  of  the  four  ACT 
computers.  The  midvalue  of  four  signals  is  defined  as  the  average  of  the  two  middle 
signals.  When  only  two  sensors  are  valid,  their  average  is  determined  in  lieu  of  a 
midvalue. 
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The  sensor  data  are  compared  across  channels.  Miscompares  detect  sensor  failures  and 
isolate  the  fault  whenever  possible.  When  a miscompare  of  two  valid  sensors  occurs,  fault 
isolation  is  not  attempted  in  the  case  of  most  sensors.  Both  sensors  are  presumed  failed 
and  the  ACT  system  continues  to  function  in  a degraded  state,  normally  discontinuing  the 
function  associated  with  the  failed  sensor  type.  The  pilot  command  transducer  and  pitch- 
rate  signals,  which  are  essential  to  safe  flight,  are  treated  differently. 

If  faults  occur  in  the  quadruply  redundant  pilot  command  transducers  so  that  a 
miscompare  of  only  two  remaining  signals  occurs,  a sensor  validity  signal  identifies  the 
good  sensor.  Safe  flight  is  continued  using  this  single  good  sensor.  The  sensor  validity 
signal  is  obtained  by  means  of  circuitry,  which  takes  the  sum  and  difference  signals 
formed  when  the  LVDT  secondary  center  tap  is  grounded.  The  difference  signal  is 
proportional  to  the  transducer  signal;  the  sum  remains  nearly  constant  for  a properly 
functioning  transducer. 

The  pitch-rate  signal  is  compared  not  only  with  the  other  pitch-rate  signals  but,  following 
a sequence  of  failures,  is  also  compared  with  an  estimated  pitch-rate  signal  based  on 
normal  acceleration  and  other  signals.  Failure  management  is  described  in  Section  G.6.0. 

The  control  laws  compute  the  servoactuator  commands  in  each  ACT  computer.  Because 
asynchronous  computation  is  involved,  the  servocommands  computed  by  the  four  ACT 
computers  will  not  agree  precisely.  Channels  are  equalized  by  noting  the  difference 
between  a particular  ACT  computer  servocommand  and  that  associated  with  the  active 
channel. 

Each  ACT  computer  is  assigned  a particular  bus  on  which  it  outputs  the  servocommands. 
The  monitor  processor  compares  the  servocommands  as  issued  on  each  bus.  Faulty 
servocommands  are  detected  and  isolated  by  the  monitor  processor  using  comparison 
monitoring  techniques.  If  three  computer  failures  ever  occur,  the  third  computer  failure 
is  isolated  by  the  computer  self-test.  The  computer  self-test  confidence  is  greater  than 
95%.  Single-channel  operation  is  permitted  following  a third  computer  failure  because 
there  is  not  an  apparent  better  alternative. 

Following  the  detection  and  isolation  of  a computer  fault,  failure  correction  must  be 
effected  by  a reassignment  of  the  actuator  buses.  Table  G-18  shows  the  computer  failure 
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states.  Computer  serial-terminal-transmit-enable  discretes  are  used  to  effect  this  logic. 
The  logic  discretes  are  a function  of  the  system  status  as  determined  by  all  the  operable 
monitor  processors  collectively. 

Failure  of  a computer  may  be  caused  by  a failure  of  the  I/O  computing  section,  the 
control  law  computer,  or  the  power  supply  or  ACT  computer  clock.  I/O  computing  can 
still  output  a satisfactory  set  of  commands  to  the  actuator  bus  if  the  monitor  processor 
fails. 


Failures  are  isolated  to  the  I/O  section,  the  control  law  section,  or  the  power  supply  or 
clock  through  self-test  features  described  in  Subsection  G.2.2.  If  the  control  law  section 
fails,  that  ACT  computer  will  reconfigure  so  that  the  I/O  section  monitors  and  midvalue 
selects  only  the  crucial  sensor  inputs.  Thus,  adequate  time  is  made  available  for  the  I/O 
processor  to  perform  the  FBW,  crucial  PAS  control  calculations.  The  ACT  computer  will 
stay  in  a hot-spare  state  until  the  system  reaches  such  a failure  state  that  only  the  FBW, 
crucial  PAS  is  functional.  At  that  time,  it  is  automatically  returned  to  an  active  control 
status.  The  result  of  this  reconfiguration  strategy  is  that  the  control  law  computing 
section  is  not  required  for  safe  flight;  the  system  flight  safety  reliability  is  improved. 


Table  G-18.  ACT  Computer  Assignment 


to  Actuator  Buses 


Computers 

failed 

Actuator  bus 

a 

B 

B 

B 

a 

B 

B 

B 

A 

o 

B 

B 

B 

B 

ra 

B 

B 

B 

C 

ra 

B 

B 

B 

D 

o 

B 

B 

B 

A,  B 

m 

B 

B 

B 

A,  C 

o 

B 

B 

B 

A,  D 

o 

B 

B 

B 

B,  C 

D 

B 

B 

B 

B.D 

D 

B 

B 

B 

C,  D 

El 

B 

B 

B 

A,  B,  C 

Q 

B 

B 

B 

A,  B,  D 

B 

B 

B 

B 

A,  C,  D 

B 

B 

B 

O 

B,C,  D 

D 

B 

B 

B 

Computer 
assigned 
to  actuator 
bus 
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The  servoactuator  position  commands  are  transmitted  to  the  individual  actuators  by  the 
actuator  buses  with  bus-actuator  assignments,  as  shown  in  Figure  G-35.  Actuator 
feedback  signals  are  returned  to  the  monitor  processors  over  the  actuator  buses.  Each 
actuator  is  modeled  by  , the  monitor  processors,  as  described  in  Subsection  G.4.2.  As 
failures  of  the  actuators  occur,  they  are  detected  by  the  monitor  processors,  and  the 
failed  actuators  are  disengaged  (bypassed).  If  an  active  actuator  is  disengaged,  an  online 
actuator  is  made  active.  The  active,  online,  disengaged  status  discretes  are  transmitted 
to  each  actuator  by  one  of  the  monitor  processors. 

G.5.3  SYSTEM  RELIABILITY 

In  this  subsection,  the  system  failure  probability  is  computed  as  it  relates  to  flight  safety 
and  to  the  loss  of  any  of  the  ACT  functions.  Dispatch  reliability  is  also  considered. 

The  probability  of  any  failure  that  might  require  a maintenance  action  is  covered  in 
Subsection  G.5.U,  "Cost-of-Ownership  Data." 

G.5.3. 1 PRELIMINARIES 

Failure  rates  taken  down  to  the  level  necessary  for  the  desired  reliability  calculations  are 
shown  in  Table  G-19.  These  failure  rates  were  estimated  as  the  average  rate  over  a 
30  000-hr  life  for  the  sensors,  actuators,  and  computing  electronics.  The  aircraft  electric 
and  hydraulic  system  failure  rate  was  derived  from  Reference  G-21. 

The  structure  of  the  1990  ACT  system  is  such  that  the  calculation  of  failure  probability 
can  be  conveniently  separated  into  three  parts: 

• Sensors  and  sensor  bus 

• ACT  computers 

• Actuators  and  actuator  bus 

Tables  G-20,  G-21,  and  G-22  show  simplified  failure  effects  matrices  that  aid  in  writing 
the  system  failure  probability  equations.  They  show  the  effect  of  a number  of  similar 
faults  on  the  operability  of  the  various  functions.  Where  no  entries  are  found  in  the  table, 
failures  of  the  particular  element  have  no  effect  on  the  availability  of  that  function;  i.e., 
that  function  does  not  require  that  element. 
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Air  data  I Normal  acceleration 


Table  G-19.  Failure  Rates  for  1990  ACT  System  Elements 


Element 

Symbol 

Per-channel  failure  rate 
X 10’®  (per  hour) 

Sensor  bus  and  controller 

1 

Pilot  command,  slat,  flap,  transducers 

5 

Pitch  rate  (IRS  source) 

30 

Normal  acceleration  (IRS  source) 

^na 

22 

Yaw  rate  (IRS  source) 

30 

Bank  angle  (or  IRS  fail) 

^IRS 

250 

Accelerometer  (W1.A  or  FMC) 

^A 

22 

Air  data  computer 

^ADC 

80 

Computer  power  supply  and  clock 

^PS 

3 

Input/output  section 

^1/0 

40 

Control  law  computation 

^CL 

30 

Monitor  computation  and  redundancy  managernent 

55 

Actuator  bus 

^AB 

1 

Hydraulic  servoactuator 

50 

Servodrive  electronics  unit  (per  channel) 

^SDEU 

13.5 

Electromechanical  actuator,  electrical  (four  per  actuator) 

^EMAE 

44 

Electromechanical  actuator,  mechanical  (two  per  actuator) 

^EMAM 

44 

Hydraulic  power  source 

^HPS 

28.6 

Electric  power  source 

^EPS 

0 

Table  G-20.  Simplified  Failure  Effects  Matrix,  Sensors 


I function  operative 
0 function  inoperative 
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Aileron 


Table  G-21.  Simplified  Failure  Effects  Matrix,  ACT  Computers 


Function 


Failed  section 


Power  supply— clock 


Number  of 
similar  faults 


Critical 

PAS 

1 

LAS 

WLA 

FMC 

AAL 

I/O  section 


Control  law 
computing 


Monitor 

computing 


Legend: 

I function  operative 
0 function  inoperative 


Table  G-22.  Simplified  Failure  Effects  Matrix,  Actuators 


Hydraulic  system 


• Failures  presumed  to  occur  in  order  of  A.  B.  C,  D for  actuator  bus  and  hydraulic  system. 

I function  operative 
0 function  inoperative 

^ Both  left  and  right  elevator  control  •'equired.  either  inboard  aileron  or  both  outboard  aileron  segments 
control  required,  either  upper  or  lower  rudder  control  required. 

^ Both  rudder  segments  control  required. 
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The  tables  were  prepared  assuming  the  failures  occur  in  the  order  A,  B,  C,  and  then  D. 
For  example,  in  Table  G-20,  the  first  sensor  bus  failure  is  of  the  A bus.  The  fourth  is  of 
the  D bus.  The  D bus  is  the  one  that  carries  only  the  crucial  sensor  signals.  If  it  were  to 
fail  first,  it  would  have  no  effect  on  the  operability  of  the  critical  ACT  functions.  A 
second  servo  bus  failure  would  then  result  in  all  the  critical  ACT  functions  being  operable. 

Combinations  of  failures  of  different  elements  in  a given  channel  are  not  considered,  but 
these  effects  must  be  included  in  the  failure  equations. 

Table  G-23  shows  the  relationship  between  the  ACT  functions  and  the  dispatchability  of 
the  aircraft  and  the  manner  in  which  flight  restrictions  are  applied  as  functional 
capabilities  are  lost.  Information  in  Table  G-23  was  obtained  from  Table  16  (vol.  I). 

G.5.3.2  FUNCTIONAL  RELIABILITY 

G.5.3.2.I  Loss  of  FBW,  Crucial  PAS 

The  equations  for  computing  the  probability  of  failure  of  the  FBW  and  crucial  PAS 
functions  of  the  ACT  system  are  shown  in  Table  G-24.  Results  of  the  calculations  using 
the  failure  rates  of  Table  G-19  are  shown  as  follows. 


Table  G-23.  Dispatch  and  Flight  Restriction  Requirements 


Function 

Flight  restriction 
associated  with 
function  loss 

Dispatch 
with  function 
loss 

Additional  dispatch 
requirements 

FBW 

Failure  probability  < 10”®^r 

Critical  PAS 

A 

Yes 

Flight  restriction  A will  apply  when  one  more 
failure  could  result  in  loss  of  PAS  function 

LAS 

B 

No 

Flight  restriction  B will  apply  when  one  more 
failure  could  result  in  loss  of  LAS  function 

WLA 

None 

No 

— 

FMC 

C 

Yes 

— 

AAL 

None 

No 

— 

Flight  diversion  required  for  combined  loss  of  critical  PAS,  LAS,  and  WLA. 
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Table  G-24.  Failure  Probability  Equations,  1990  ACT— 

Fly  by  Wire,  Crucial  Pitch-Augmented  Stability 


Element 

Failure  situation 

Equation 

Sensors 

Failure  occurs  if  four  pilot-control  transducers 
fail  or  two  pitch-rate  signals  and  two  normal 
acceleration  signals  fail 

^SENSORS  °n^  * 

[Qsb  + Qps)'^ 

Computers 

Failure  occurs  if  three  I/O  computers  fail  and 
self-test  does  not  Indicate  failed  computer 
(95%)  or  if  four  monitor  computers  fail 

^COMPUTING  “ 

4q3q  (1-0.95)-^qJ,  +qJs 

-1-40^3  ( *^1/0  ^m) 

[Q|/o  n-o.95)  + Q^" 

Actuators 

Failure  occurs  if  four  of  four  rudder  actuators 
fail,  or  three  of  three  right  elevator  actuators  fail, 
or  three  of  three  left  elevator  actuators  fail,  or 
two  of  two  inboard  aileron  and  two  of  two  out- 
board aileron  inboard  section  fail,  or  two  of  two 
outboard  aileron  outboard  sections  fail 

‘^ACTUATORS"' 

(rudder)  + 2Q^  (elevator)  + 

2Q^  +Qh}  + 

(°AB  * ^HPs)  ^ (‘^AB  *^HPs)  ^ 

(i2Qh  + 7q2) 

*{°as*°hk)  (’“h  *’“h) 

Q = Xt,  where  Q = failure  probability 
X = failure  rate 
t = mission  time 


Probability  of  FBW,  Crucial  PAS  Failure  Function 


1-hr  flight 

4-hr  flight 

Sensor 

4.04  X 10’^^ 

1.03  X 10'^^ 

Computing 

1.39  X 10“^^ 

890.4  X 10"^^ 

Actuation 

1.69  X 10"^^ 

108.16  X 10"^^ 

System 

1.70  X 10'^^ 

109.0  X 10‘^^ 
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G.5.3.2.2  Loss  of  Normal  Mode 


The  equations  for  computing  the  probability  of  loss  of  any  of  the  ACT  functions  are  shown 
in  Tabie  G-25.  The  results  of  the  calculations  are  shown  as  follows. 


Probability  of  Loss  of  Any  ACT  Function 


1-hr  flight 

4-hr  flight 

Sensors 

2.15  X 10"^ 

3.45  X 10"^ 

Computing 

1.56  X 10"^^ 

99.6  X 10"^^ 

Actuation 

5. if  X 10"^ 

865.0  X 10‘^ 

System 

2.70  X 10’^ 

4.312  X 10'^ 

Table  G-25.  Failure  Probability  Equations,  1990  ACT— AH  Control  Functions 


Element 

Failure  situation 

Equation 

Sensors 

Failure  occurs  if  four  command  transducers  fail, 
or  two; 

• Slat  or  flap  transducers  fail 

• Pitch-rate  signals  fail 

• WLA  accelerometers  fail 

• FMC  accelerometers  fail 

• IRS  fails 

• ADC  fails 

• Two  of  sensor  buses  A,  B,  or  C fail 

^SENSORS ° 

6q4  -M2q2  +12Q^  +3Q2pg 

^*^ADC^  ^(°SB  *^Ps)^ 

+ 6(Qsb  + Qrs)  ('^Qx  ^"^A  *^l RS  ^ADc) 

Computing 

Failure  occurs  if  three  power  supply/clocks 
fail  or  three  control  law  computing 
sections  fail,  or  four  monitor 
computers  fail 

COMPUTING  = 

4Q^S  ■^'^('^I/0'^°Cl)^'^^M 
■^^2Qps  [Q|/0'^^CL'*’%^] 

-I-  12Qpg  [(Q|/o  + *^Cl)^  * 

Actuators 

Failure  occurs  if  two  of  two  upper  or  lower 
rudder  actuators  fail,  or  two  of  three  right 
or  left  elevator  actuators  fail,  or  two  of  two 
right  or  left  outboard  ailerons  outboard 
fail,  or  two  of  two  right  or  left  outboard 
ailerons  inboard  fail,  or  two  of  two  right 
or  left  inboard  ailerons  fail,  or  two  of 
three  actuator  bus  or  hydraulic  power 
sources  fail,  or  three  of  four  EMA  electric 
channels  fail  for  either  right  or  left  inboard 
or  outboard  flaperons 

° ACTUATORS" 

2q2  +8Qh2-^3(Qab+Qhps)^ 
■^(°AB'*’‘^HPs)^ 

+ ^[4  (Osdeu  + °EMAe)^  ‘^EMAm2] 
* ®°AB^  (*^SDEU  °EMAe)] 

'^^AB  (°SDEU  °EMAe)^] 

Q = Xt,  where  Q = failure  probability 
X = failure  rate 
t = mission  time 
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G.5.3.3  DISPATCH  RELIABILITY 


Dispatch  was  examined  for  the  following  cases: 

• One  ACT  computer  failed 

• One  IRS  failed 

• One  air  data  computer  failed 

• One  aileron  actuator  failed 

• Flaperon  EMA,  SDEU,  or  FMC  accelerometers 

G.5.3.3. 1 ACT  Computer 

The  airplane  can  be  dispatched  with  one  ACT  computer  failed.  The  probability  of 
functional  failure  of  the  remaining  ACT  computers  during  a 2-hr  flight  is: 

• 2.6  X 10’^*^  for  crucial  functions 

g 

• 1.6  X 10“  for  critical  functions 

It  is  assumed  that  a sensor  bus  controller  function  is  not  lost  as  a result  of  the  ACT 
computer  failure. 

G.5 .3.3.2  Inertial  Reference  System 

Loss  of  either  a pitch-rate  signal  or  an  accelerometer  signal  would  result  in  the  crucial 
function  sensor  failure  rate  being  dominated  by  the  term  associated  with  pitch  rate  and 
normal  acceleration.  This  sensor  failure  rate  term  would  be: 

^SENSOR  M ^ ^ Qq-  %z  ^ 

QsENSOR<8.1  X lO-'^^d-hr  night) 


(This  is  explained  in  more  detail  in  Section  G.6.0.) 

A failure  of  one  IRS  does  not  cause  the  loss  of  any  critical  ACT  functions,  but  the 

-4 

probability  of  loss  of  function  of  LAS  becomes  approximately  5x10  during  a 1-hr  flight. 
This  is  the  probability  of  either  of  the  two  remaining  IRSs  failing. 
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G.5.3.3.3  Air  Data  Computer 


A failure  of  one  of  three  air  data  computers  does  not  result  in  any  functional  loss. 
However,  the  probability  of  loss  of  the  ACT  functions  requiring  air  data  signals  becomes 
1.6  X 10“^  during  a 1-hr  flight. 

The  loss  of  any  one  sensor  of  types  other  than  the  IRS  or  air  data  computer  would  not 
preclude  airplane  dispatch. 


G.5A  COST-OF-OWNERSHIP  DATA 


Cost  of  model  input  data  is  provided  in  this  subsection.  These  data  were  prepared  to 
allow  Boeing  to  compute  the  cost  of  ownership  for  the  1990  ACT  system.  Cost-of- 
ownership  data  are  presented  in  Tables  G-26  and  G-27. 


Table  G-26.  Line  Replaceable  Unit  Cost  and  Reliability  Data 


A 

B 

C 

D 

E 

Component 

Quantity 
per  shipset 

MTBF 

(LRU) 

MTBUR 

Spares 

per 

airplane 

LRU 
weight, 
kg  (lb) 

Flight  control  computer 

4 

7 674 

2 257 

5 

5.4  (12.0) 

Servodrive  electronics  unit 

8 

37  000 

10  882 

4 

6.35(14.0) 

Sensors 

Control  position  transducer 
• Pitch 

2 

50  000 

m 

3 

0.9  (2.0) 

• Roll 

2 

50  000 

3 

0.9  (2.0) 

• Yaw 

2 

50  000 

wgsm 

3 

0.9  (2.0) 

• Stabilizer 

1 

50  000 

3 

0.9  (2.0) 

• Slat  position 

2 

66  666 

ISI 

3 

0.7  (1.5) 

• Flap  position 

2 

66  666 

mgm 

3 

0.7  (1.5) 

Accelerometer,  wing  FMC 

2 

15  150 

3 

0.9  (2.0) 

Accelerometer,  wing  WLA 

2 

15  150 

■■ 

3 

0.9  (2.0) 

Servos 

Electromechanical,  flaperon 

4 

3 773 

1 110 

7 

21.8  (48.0) 

Electrohydrauiic 
• Outboard  aileron  inboard 

2 

10  000 

2 941 

4 

5.08(11.2) 

• Elevator 

6 

20  000 

5 882 

4 

4.72  (10.4) 

• Rudder 

4 

20  000 

5 882 

4 

7.98  (17.6) 

• Outboard  aileron  outboard 

4 

20  000 

5 882 

4 

2.77  (6.1) 

• Inboard  aileron 

4 

20  000 

5 882 

4 

3.45  (7.6) 
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Table  G-27.  Maintenance  Labor  and  Materials 


A 

B 

C 

D 

E 

F 

Component 

Removals  per 

Maintenance  hour  per  flight  hour 

Dollars  per  flight  hour 

flight  hour 

Line 

Shop 

Line 

Shop 

Material 

ACT  computer 

0.000443 

0.15 

1.25 

0.002 

0.017 

0.0155 

Servodrive  electronics  unit 

0.000092 

0.15 

1.25 

0.0004 

0.0034 

0.0032 

Sensors 

Control  position  transducer 
• Pitch 

0.000068 

0.25 

■ 

0.0005 

0.0005 

0.0026 

0.0026 

0.0024 

0.0024 

• Roll 

0.000068 

0.25 

0.0005 

0.0026 

0.0024 

• Yaw 

0.000068 

0.25 

1.25 

0.0005 

0.0026 

0.0024 

• Stabilizer 

0.000068 

0.25 

1.25 

0.0005 

0.0026 

0.0024 

• Slat  position 

0.000051 

0.25 

1.25 

0.0004 

0.0019 

0.0018 

• Flap  position 

0.000051 

0.25 

1.25 

0.0004 

0.0019 

0.0018 

Accelerometer,  wing  FMC 

0.000224 

0.25 

1.25 

0.0017 

0.0084 

0.0078 

Accelerometer,  wing  WLA 

0.000224 

0.25 

1.25 

0.0017 

0.0084 

0.0078 

Servos 

Electromechanical,  flaperon 

0.0009 

0.5 

1.25 

0.0135 

0.0338 

0.0315 

Electrohydraulic 
• Outboard  aileron  inboard 

0.00034 

0.5 

1.25 

0.0051 

0.0128 

0.0119 

• Elevator 

0.00017 

0.5 

1.25 

0.0026 

0.0064 

0.006 

• Rudder 

0.00017 

0.5 

1.25 

0.0026 

0.0064. 

0.006 

• Outboard  aileron  outboard 

0.00017 

0.5 

1.25 

0.0026 

0.0064 

0.006 

• Inboard  aileron 

0.00017 

0.5 

1.25 

0.0026 

0.0064 

0.006 

The  spoiler  actuators,  flap  actuators,  air  data  computer,  IRS  and  caution  and  warning 
system,  ACT  Maintenance  and  Display  Computer,  and  dedicated  ACT  panel  are  considered 
either  associated  equipment  or  unchanged  from  the  Baseline  Configuration.  Table  G-27 
shows  the  maintenance  cost  estimate- 


Maintenance  manual  preparation  cost  is  estimated  at  $547  000.  These  costs  are  prorated 
across  10  airlines  assumed  to  buy  fleets  of  30  aircraft  each  ($55  000  per  airline).  "Line 
Operational  Check  and  Maintenance"  handbooks,  "Intermediate  and  Depot  Fault  Isolation 
Repair  and  Overhaul"  manuals,  and  "Illustrated  Parts  Breakdown"  manuals  are  included. 

The  cost  for  developing  and  conducting  a training  course  consisting  of  16  hr  of  flight-line 
operation  training  and  40  hr  of  shop  training  is  $17  000.  This  number  is  applicable  to 
training  as  an  investment  cost. 
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The  cost  per  airline  for  additional  56-hr  training  classes  is  $2900.  Assuming  a 
requirement  of  2.5  classes  per  year  for  the  first  5 years  results  in  a yearly  cost  of  $7500. 
Only  one  class  per  year  would  be  anticipated  after  5 years  ($2900  per  year). 

All  LRUs  of  the  ACT  system  can  be  tested  on  general-purpose  automatic  test  equipment 
(ATE)  procured  separately  by  the  airlines.  Software  costs  for  the  ATE  are  estimated  at 
$10  000  per  airline  assuming  that  the  ATE  program  requires  only  minor  diagnostic 
sequence  additions  to  the  factory-test  ATE  software. 
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G.6.0  lAAC  PITCH-RATE  OBSERVER 


The  reliability  specifications  for  the  lAAC  1990  contract  require  that  the  probability  of  a 

_Q 

catastrophic  failure  be  less  than  1 x 10  . This  specification,  the  crucial  failure 
requirement,  dictates  a sensor  failure  probability  budget  of  1 x 10”^®.  (This  is  a 
conservative  number;  the  estimated  order  of  magnitude  is  the  key  design  parameter.) 

The  open-loop  aircraft  is  statically  unstable;  therefore,  the  pitch-rate  signal  in  the  Boeing 
control  law  (fig.  G-43)  is  the  crucial  sensed  output.  To  reduce  costs,  sensors  should  be 
shared  with  the  inertial  reference  system  (IRS),  which  is  manufactured  by  Honeywell. 

Although  the  IRS  provides  three  accurate  pitch-rate  signals  from  ring  laser  gyros  (RLG), 
three  sources  are  not  enough  to  meet  the  crucial  specification.  Triplex  voting  provides  a 
catastrophic  failure  probability  of 

Pp  = 3X-Q  - 2X^q  (estimate  for  1 hr) 

Aq  = 30  X 10“*^  RLG  failures/hr 

Therefore 

Pp  = 3Xq  = 8.1  X 10"^ 


Eight  gyro  status  signals  provide  about  95%  coverage  on  self-test.  The  failure  probability 
then  becomes 

Pp  ^x3q  + 3x2q  (l-C) -3x3q(1 -C) 

where 

A 

C = coverage,  0 < C < 1 
for  C = 0.95 

Pp  = 3X^q(0.05)  = 4.05  X 10-^0 


G-I53 


Actuator 


Figure  G-43.  lAAC  Pitch-Augmented  Stability 


This  is  close  to  the  budget  of  1 x 10"^^  and  probably  would  be  acceptable.  However,  the 
airlines  would  like  to  dispatch  an  airplane  from  a remote  location  (a  route  stopover 
without  maintenance  facilities)  with  one  failed  component.  This  desire  dictates 
dispatching  with  only  two  IRS  pitch-rate  signals.  The  failure  probabilities  for  meeting  the 
crucial  specification  with  only  dual  sensors  do  not  come  close  to  compliance. 

One  software  technique  makes  optimum  use  of  the  IRS  to  provide  the  extra  missing 
signals.  Because  the  IRS  contains  triplex  accelerometers,  the  possibility  can  be  explored 
of  using  normal  acceleration  (n^)  in  the  crucial  flight  control  system  in  lieu  of  failed 
pitch-rate  gyros. 

The  design  constraints  of  a pitch-rate  observer  from  normal  acceleration,  assumed  at  the 
outset,  are: 

• A simple  design  is  desired  for  maximum  reliability:  i.e.,  minimum  order  with 
minimum  sensor  inputs. 
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• IRS  sensors  have  superior  noise  characteristics;  therefore,  a minimum  variance 
design  is  a secondary  consideration. 

e The  closed-loop  design  must  meet  a root  locus  specification,  as  shown  in 
Figure  G-44.  Gain  and  phase  margin  specifications  are: 

• Low  frequency  (phugoid),  w < 0.05  rad/s 

• Gain  margin  = +4  dB 

• Phase  margin  = 20  deg 

• High  frequency  (short  period),-  0.05  rad/s  < cu<  bending  frequencies 

• Gain  margin  = +6  dB 

• Phase  margin  = +45  deg 

G.6.1  REDUCED  ORDER  LUENBERGER  OBSERVER 

To  demonstrate  the  feasibility  of  the  observer  concept,  a design  at  one  flight  condition 
was  modeled.  The  objective  was  to  duplicate  the  closed-loop  performance  of  the  Boeing 
design  (fig.  G-43)  with  an  n^  feedback  (estimating  q)  in  lieu  of  actual  pitch  rate.  The 
chosen  flight  condition  and  aircraft  model  are  displayed  in  Figure  G-45. 

Although  the  model  includes  the  phugoid  dynamics,  the  design  was  modeled  only  on  the 
short-period  representation  plus  a first-order  actuator  (w^  = 20  rad/s).  Using  Honeywell's 
eigenspace  placement  software,  a second-order  observer  was  designed.  Observer  poles 
were  placed  at  7 and  15  rad/s.  Implementation  of  the  resulting  design  is  shown  in 
Figures  G-46  and  G-47. 


G.6.2  DESIGN  RESULTS 

Closed-loop  roots  for  both  the  Boeing  and  the  observer  designs  are  shown  in  Table  G-28. 
Figure  G-48  shows  the  stability  margins  for  the  Boeing  control  law;  Figure  G-49  shows  a 
transient  response  to  a step  command.  Figure  G-50  shows  the  stability  margins  for  the 
observer  in  the  loop,  and  the  observer  design  step  response  is  shown  in  Figure  G-51. 
Pitch-rate  observer  performance  is  shown  in  Figure  G-52.  Design  results,  in  summary, 
are: 
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Figure  G-44.  Minimum  Damping  Requirements— Longitudinal  Roots 
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• Some  high-frequency  gain  margin  is  sacrificed  using  the  n^  feedback,  but  the  result 
(8  dB)  is  still  within  specification. 

• The  roots  for  both  designs  are  well  within  specifications. 

• The  transient  responses  are  very  close  (to  10  sec),  which  indicates  that  for  this 
condition,  at  least,  the  flight  can  continue  unrestricted. 

• A plot  of  actual  pitch  rate  versus  estimated  q (fig.  G-52)  indicates  a good  high- 
frequency  match,  but  less  than  perfect  low-frequency  comparison.  This  agrees  with 
the  high-frequency  (short-period)  design  philosophy. 

Flight  Condition  8,  Altitude  = Sea  Level,  Vj  = 128.7  m/s  (422.1  ft/s) 

Using  state-space  differential  equations 
X = Ax  Bu 

where 

X is  the  state  vector 
u is  the  control  vector 
A is  the  state  coupler  matrix 

B is  the  control  coupler  matrix 

a.  Short-period  and  phugoid  modes  (for  use  with  control  laws) 


“ -5.89  X 10-3 
-2.08  X 10-"^ 
-3.75  X 10-5 

3.37  X 10-1 
-8.65  X lO-'' 
8.32  X 10-2 

-2.71  X 1Q1 
9.80  X 10-'' 
-6.61  X 10-'' 

-3.21  X 1Q1 
-4.99  X 10-3 
0 

; B = 

1.34 

-4.83  X 10-2 
-1.74 

0 

0 

1.00 

0 

_ 0 _ 

x"*^  = (u,  a,q,e);u  = 6g 


b.  Observer  design  model  (includes  20-rad/s  actuator) 


“-8.65X  10-'' 

9.79  X 10-'' 

-4.83  X 10-2  “ 

“ 0 " 

A = 

8.32  X 10-2 

-6.61  X 10-'' 

-1.74 

; B = 

0 

0 

0 

-2.00x10''  - 

_ 2.00  X 1q1  _ 

x^  = (a,  q,  5e);  u =6- 

Figure  G-45.  lAAC  Longitudinal  Axis  Models 
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KU  = 0.0002 

Figure  G-46.  lAAC  Pitch-Augmented  Stability  With  Observer 


Figure  G-47.  Pitch-Rate  Observer 
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Table  G-28.  Pitch-Augmented  Stability  Design  Roots 


Eigenvalues 

Frequency 

Damping 

real 

Imaginary 

ratio 

Open 

loop 

-1.06469178 

-10.00000048 

-0.44270060 

-0.20004747 

0.04717238 

-0.07205359 

-20.00000000 

-40.00000000 

Closed 

loop, 

observer 

design 

-25.07090735 
-38.62446833  ' 
-3.48650715 
-3.48650718 
-0.86118771 
-0.06577497 
-0.06577497 
-0.07119391 

4.69497484 

-4.69497484 

0.04580707 

-0.04580707 

5.84795010 

5.84795016 

0.08015382 

0.08015382 

0.59619304 

0.59619304 

0.82060931 

0.82060931 

Closed 

loop, 

Boeing 

design 

-18.38132358 

-57.38672113 

-6.35998458 

-6.35998464 

-5.45896631 

-0.88066266 

-0.06735528 

-0.06735528 

-0.05206975 

4.43677247 

-4.43677240 

0.08903743 

-0.08903743 

7.75463432 

7.75463438 

0.11164407 

0.11164407 

0.82015274 

0.82015274 

0.60330373 

0.60330373 
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Figure  G-48.  Boeing  Design  Stability  Margins 
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Figure  G-49.  Pitch  Axis  Step  Response,  Boeing  Design  (Continued) 
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Figure  G-51.  Pitch  Axis  Step  Response,  Observer  Design  (Continued) 


G-166 


6,  rad 


(S/JJ)  S/Ol  ' 


G-16^ 


6 


8 


10 


s/pej  'b 


G.6.3  CONCLUSIONS 


The  feasibility  of  using  an  observer  in  lieu  of  a pitch-rate  sensor  was  demonstrated  in  the 
lAAC  control  law  for  one  flight  condition.  The  end  result  is  a net  increase  in  system 
reliability  at  no  extra  hardware  cost  and  at  low  software  costs. 

Using  a failure  management  scenario,  as  shown  in  Table  G-29,  the  catastrophic  failure 
probability  is 

Pp  < 3\~  ■ 3X2  (for  1 hr) 

^ Q nz 

Assuming 

X = Xq  = Xj^2  = 3.0  X 10"^  failures/hr 
Pp  < 9X^=  7.3  X 10"^^ 


( X is  a conservatively  high  failure  rate  for  accelerometers) 

Furthermore,  if  a sensor  (either  gyro  or  accelerometer)  fails,  the  dispatch  catastrophic 
failure  probability  is 

Pp  < 3X2  = 8.1  X 

Both  numbers  are  well  below  the  budget  of  10”^®  for  sensors. 

Other  features  are: 

• Failure  detection  and  isolation  is  performed  with  high-coverage  comparisons. 

• Analytical  redundancy  can  add  capability  to  the  system;  however,  the  simplified 
reliability  analysis  used  here  indicates  that  it  is  not  necessary. 
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Table  G-29.  Fail-Operational  Scenario  for  Crucial  Pitch-Augmented  Stability 


Failure  mode 

Status  prior 
to  failure 

Failure  detection 
scheme 

Reversion 

mode 

First  gyro  fails 

Three  gyros,  plus 
three  accelerometers 
up 

Midvalue  select 
and  cross-channel 
monitor 

Run  control  law 
on  average  of 
remaining  gyros 

Second  gyro  fails 

Two  gyros,  plus 
three  accelerometers 

Cross-channel  monitor 
to  reject  both 
gyros 

Switch  to  q 
observer  using 
n^  sensors  * 

First  accelerometer 
fails 

No  usable  gyros, 
plus  three 
accelerometers 

Midvalue  select  and 
cross-channel  monitor 

Run  observer  on 
average  of 
remaining 
accelerometers 

Second  accelero- 
meter fails 

An  AR  determined 
"good"  gyro  and 
two  accelerometers 

Cross-channel  monitor 
to  reject  both 
accelerometers 

Run  PAS  with 
remaining  gyro 

Note:  This  scenario  is  not  the  only  fault  sequence;  it  is  used  to  illustrate  the  management 

system. 


* Use  analytical  redundancy  to  determine  healthy  gyro  or  accelerometer  for  later  use. 
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G.7.0  CONCLUSIONS  AND  RECOMMENDATIONS 


An  ACT  system  has  been  defined  that  demonstrates  that  the  cost-of-ownership 
parameters  will  be  favorably  affected  by  the  anticipated  technological  advances.  Most 
important  of  the  developments  are: 

• Integrated  circuit  developments 

• Extensive  busing 

• Software  improvements 

Integrated  circuit  developments  will  decrease  the  volume  and  increase  the  reliability  of  a 
given  computer  function  by  a factor  of  4 to  10.  Comparable  speed  increases  will  be 
realized.  The  effect  of  the  military  stimulus  to  the  development  of  very-large-scale, 
very-high-speed  integrated  circuits  will  result  in  full-temperature-range  standard  circuits 
being  available  to  respond  to  many  requirements.  Custom  large-scale  integrated  circuits 
will  be  favorable  financially  in  many  other  cases.  ' 

Partially  as  a result  of  these  developments,  more  extensive  busing  will  be  used.  Remote 
terminals  will  be  included  with  each  sensor  and  servoactuator.  Essentially,  all  signal 
transmission  will  be  via  serial  data  buses  with  attendant  reduced  weight  and  cost.  The 
ease  with  which  signals  from  all  sensors  may  be  made  available  to  all  controllers  will 
allow  data  crossflow,  which  will  enhance  reliability. 

Software  will  be  easier  to  prepare  and  validate.  Most  of  the  software  will  be  prepared 
using  a higher  order  language.  The  timing  difficulties  associated  with  synchronous 
computer  operations  are  avoided  in  the  1990  ACT  system.  The  software  is  naturally 
partitioned  by  the  separation  of  functions  brought  about  by  the  inclusion  of  input/output, 
control  law,  and  monitor  computers.  The  speed  of  the  computers  is  high,  so  the  time 
loading  is  of  little  consequence  to  the  software  designer. 

Fly-by-wire  control,  included  in  all  three  axes,  will  improve  performance  and  allow  added 
flexibility  in  cockpit  design. 

It  is  recommended  that  additional  work  be  performed  on  advanced  architectures  for  flight 
control.  The  digital  fly-by-wire  system  architecture  of  today  is  exemplified  by  the  low- 
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risk  architecture  described  in  Subsection  G.3.2.  Its  features  have  evolved  over  a decade 
of  industry  development.  Several  shortcomings  were  uncovered  in  the  studies  of  the  1990 
ACT  architecture.  In  each  case,  these  were  corrected  so  they  are  not  present  in  the 
system  described  in  Section  G.5.0.  However,  it  is  likely  that  additional  examination  and 
definition  will  point  to  still  other  areas  for  change.  - 
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